Have been managing email server for my friend’s small business but eventually we also decided to use vendor because the cost of maintenance is high.

BSD as a virtualization host doesn’t seem to be good, so better stick with Linux.

I would just run Jellyfin or other stuff with LXC, of course firewall should be in VM, probably only needs 4G ram and it’s more than enough.

If you can completely isolate it so that only management network+ unRAID are reachable, then it’s fine.

Outside network is one attack domain, however don’t forget that if your PC or other mobile devices on network are infected by virus or malware, they can initiate attack from inside, look at the case of WannaCry in the past.

Just PiHole and then VPN with split tunnel so that only DNS is using home one.