Hello, I host my own mail server with Roundcube as a webmail, integrated with Radicale for the contacts and calendar. Hope it helps !

It is up to you. Using Docker makes it easier for administration and evolution, but bare metal is sufficient if you are comfortable with it (which every self-hoster should be).

I use port forwarding with Nginx and Crowdsec for the services I want widely exposed, and Wireguard for those I want accessed only by myself.