In the oidc provider in authentik you have to enable sending the groups. I forgot what its called.

Roles in authentik are for permissions in authentik. You want a group instead. Group memberships are send via OIDC.

I would put truenas on the NAS, also put a VM on truenas with 16-24G of RAM.

Create a kubernetes or docker swarm cluster with server 1 and the nas vm and just have everything as containers. This way you just have one resource pool, and the containers will be started wherever there are enough resources available. The containers will mount NFS shares from truenas which truenas will create automatically as ZFS datasets. ZFS supports snapshots.

This is probably the way, because a traditional “mail server” is actually 4-5 different servers working together.

• postfix for SMTP
• dovecot for IMAP
• amavis to plug in…
• spamassassin as anti spam
• clam-av as antivirus

And they can all be very easily misconfigured to break everything completely. Great learning experience though.

I’m not sure, I got a used Pixel so I can use graphene.

It exists and is called graphene OS. It is primarily focused on privacy and security though and as such only supports google pixels since they have both good hardware security and fast security patches. Most others fail at one of the two.

Otherwise you could install calyx OS.

Jokes on you, using AI I got that time down to 4 hours trying to convince it to create working code, and 3 hours of debugging.

Nextcloud has collabora integrated.

I would put this stuff behind VPN.