Use vlans to create a dmz you can place a server only for public Internet facing stuff.

I would never buy “a second laptop”, that’d be unnecessary and wasteful. I have the one laptop I use for everything and take everywhere, plus the previous laptop as a backup. Right now this is an XPS 15 9560. Even though is in perfect nick the CPU (i7-7700HQ) just isn’t strong enough to do the work I’m doing these days, therefore I’ve preordered a F16 and once I have it my XPS will be “the old laptop”, my backup. The “old old” laptop gets donated to whoever needs one.

You contradict yourself on paragraphs 5 and 7. First you say it’s reachable from the outside then it isn’t.

DIY always better for an all around server which is a nas but also a application server.

I have an old i7-7700T with 32gb ram in a fractal node 304 case, running Ubuntu and 3x4tb drives in zfs raidz1. There’s little it can’t handle.