they/she 🏳️🌈🏳️⚧️🌱 https://animalclock.org/uk/
I’ve used wireguard for a few years. The container isn’t essential, but I prefer to have all my service configs contained and separate from the host OS.
So basically you’ll just have one WAN->LAN port forward for Wireguard. Connect to that remotely, and you’ll be able to access everything inside your LAN.
I’ve run Zentyal Community on a cheap 1c/2gb VPS for probably 5+ years. Receiving email has never been a problem, and I basically don’t get spam. My top tip is to use a unique alias for everything, e.g. thirdpartyname.randomstring@your.domain every single time you have to give your email address for something. That way, when a third party is compromised and your provided alias starts receiving spam, you can just update your alias with them and on your MX. If you deliberately make any of your aliases public, you’ll probably want to setup rspamd and postgrey.
Getting opendmarc, opendkim, certbot, etc set up in a way that Zentyal wouldn’t nuke it everytime it updated was the biggest hassle for me, and I seem to remember having to open a ticket with Microsoft to get my outbound emails accepted by O365 too. Shouldn’t be an issue anyway if you use a smarthost for outbound.
This definitely isn’t an endorsement of Zentyal btw. In fact, to be clear, most of my setup efforts were spent fighting its design decisions. I’d recommend that you find something containerised which is well maintained and does only what you need. And put some time aside, especially if you’ve never set up an MX from scratch before.
I always use a yaml file for user config but json is fine, too