Maybe consider mailbox.org. It is cheap, supports custom domains and is hosted in Germany.

If you are willing to consider commercial products, I can recommend Synology DiskStations (at least the plus series). Samba shares are quite easy to setup, you can use Synology Drive to sync a folder between workstations and Android phones which I use for Obsidian for note taking. They also have calendar options, but I use a hosted account at posteo for that.

If you want to stick to nextcloud but don’t want to host it, you could consider Hetzner Storage Share. It’s fully managed and worked great for me so far. But I only use it to share photos with others, so not all features.

Why you chose to open a port, if you use cloudflare? Couldn’t you use cloudflare tunnel in that case?

If anyone searches for a comparable alternative for Signal, I can recommend https://github.com/bepaald/signalbackup-tools. You can export a backup in Signal Android and decrypt it and export HTML with that cli. It even offers search via Javascript.

If you get a bit deeper into virtualization you might want to consider proxmox. Proxmox can just backup entire VMs and restore them.

Not sure, why you want to host email yourself. If it is just for privacy reasons, you could also have a look into posteo.de (I am customer for years, no ads, nearly zero spam, you can even pay with cash if your like) or mailbox.org. German providers and especially posteo is really tracking a minimum amount of data, just as much as they are required by law.

Proxmox or TrueNAS scale I suppose. Alternatively just pure Debian/Ubuntu, you could install cockpit on top for easier administration https://cockpit-project.org/

As always, it depends. If you don’t require public access, just remote access, I typically recommend VPN like tailscale. If you expose it publicly, you might want to authenticate users somehow and might enforce TLS. If you feel not confident about exposing out from your network, you could consider running it on a VPS or even a PaaS like fly.io, which help a lot with security concerns, they expose tls via their load balancers, you just own the HTTP server which you package into docker.