OpenOffice is a zombie at this point.

Shelter?

Jellyfin is completely free. I only used it shortly in my LAN environment so I can’t give you any numbers. It should roughly be in the same ballpark as plex though.

You can skip fail2ban for SSH. I missed the important bit. Duh…

Never used Plex but had a good experience with Jellyfin.

Just a few thoughts:

• don’t cheap out. Building your whole stack on top of free or ultra budget providers is going to backfire eventually
• check the traffic limits if you want to stream 4k content from your NAS
• if latency and bandwidth is a concern, you need to select a VPS provider with good peering. This fully depends on your ISP.
• i’d recommend setting things up with split DNS. Your DNS server would answer with local IPs for queries from within your LAN and with the IP of the VPS for external queries.
• take a look at AdGuard Home
• you can skip fail2ban if you go straight for ssh keys
• 100% wireguard

I’d be happy if Russia would simply send its soldiers home.

it’s the Iraq war all over again

Oh so you’re against the invasion after all?

Did you enable forwarding via sysctl?

sysctl net.ipv4.ip_forward

This should report 1

You only need the masquerade rule.

iptables -t nat -A POSTROUTING -s 10.11.13.0/24  -o enp3s0 -j MASQUERADE

ext4 + mdadm + dm-integrity would solve the bit rot problem. But you’d end up with a lot of parts bolted together and still miss out on the features that btrfs/zfs provide.