Hello, I host my own mail server with Roundcube as a webmail, integrated with Radicale for the contacts and calendar. Hope it helps !

I use port forwarding with Nginx and Crowdsec for the services I want widely exposed, and Wireguard for those I want accessed only by myself.

There must be a way to open ports on your modem (that is NAT forwarding). If no port is open, there is no way to gain access to your server. If a port is open, then there might be a way for an intruder to get into your network. The reality is a bit more complex (man in the middle, …) but it would make sense only if your data is of value or if someone means you harm.