@prologic@twtxt.net I do similar. Though probably much more simple.. I have CGNAT and use wireguard to VMs to punch through for stuff like HTTP/SSH from external.

And for SMTP I have smart hosts on the VMs that will store anf forward to my mailbox if the connection goes down.