Maybe consider mailbox.org. It is cheap, supports custom domains and is hosted in Germany.

If you are willing to consider commercial products, I can recommend Synology DiskStations (at least the plus series). Samba shares are quite easy to setup, you can use Synology Drive to sync a folder between workstations and Android phones which I use for Obsidian for note taking. They also have calendar options, but I use a hosted account at posteo for that.

If you want to stick to nextcloud but don't want to host it, you could consider Hetzner Storage Share. It's fully managed and worked great for me so far. But I only use it to share photos with others, so not all features.

Why you chose to open a port, if you use cloudflare? Couldn't you use cloudflare tunnel in that case?

If anyone searches for a comparable alternative for Signal, I can recommend https://github.com/bepaald/signalbackup-tools. You can export a backup in Signal Android and decrypt it and export HTML with that cli. It even offers search via Javascript.

If you get a bit deeper into virtualization you might want to consider proxmox. Proxmox can just backup entire VMs and restore them.

Not sure, why you want to host email yourself. If it is just for privacy reasons, you could also have a look into posteo.de (I am customer for years, no ads, nearly zero spam, you can even pay with cash if your like) or mailbox.org. German providers and especially posteo is really tracking a minimum amount of data, just as much as they are required by law.

Proxmox or TrueNAS scale I suppose. Alternatively just pure Debian/Ubuntu, you could install cockpit on top for easier administration https://cockpit-project.org/

As always, it depends. If you don't require public access, just remote access, I typically recommend VPN like tailscale. If you expose it publicly, you might want to authenticate users somehow and might enforce TLS. If you feel not confident about exposing out from your network, you could consider running it on a VPS or even a PaaS like fly.io, which help a lot with security concerns, they expose tls via their load balancers, you just own the HTTP server which you package into docker.

What about VPN? If you don't care if a third party is involved, as long as the traffic is encrypted, I can recommend using Tailscale. Install the client on the target and your system and just copy files as you would be in the same LAN by using their 100.x.x.x adresses. If you want to be totally independent of other vendors, you can setup wireguard (also used internally by tailscale) and connect your clients.

If you can't open ingress ports on any of your sides and you don't want to use tailscale, you can still spun up a cheap VPS, install wireguard there and connect your clients system and your client both via VPN to this system. Afterwards, you can copy files via the internal wireguard IPs.

But, if you look for a simple solution, tailscale is my preferred way. You could even use taildrop to transfer files https://tailscale.com/kb/1106/taildrop/