**All publix facing services have fail2ban running to mitigate intrusion attempts.  IPs are blocked promptly on detection.

Primary Webserver / mail server (VM):
Rocky 8 build, featuring Apache for the mail web deployment server.
Other services are:
Postfix for SMTP mail
Dovecot for inbound mail (POP/IMAP)
Mailman2 for mailing list management (I keep meaning to move to Mailman 3, but that's a WIP)

SMTP (VM): 
Rocky 10 build, running postfix & remotely authenticating against the primary mail server to align mail accounts

SSH (VM):
Yes, I run remote access via SSH, this is a separate VM, providing a bit of a buffer between the main web acccess VM & the internet, so there's no direct console link to that VM

Jellyfin / Media (Bare Metal):
Yep, I have my media collection on a machine.  This one's a Rocky 10 build, I have Jellyfin for playback, TubeArchivist for my commonly watched Youtume streams, and this one hosts one of my internal DNS hosts.
DNS is Bind 9, configured only to resolve for internal hosts.  This machine is also my primary syslog server (yep, centralised logging for all hosts).

Public DNS (VM):
A Rocky build running Bind 9, configured to serve my self hosted domins, but recursion has been turned off for all public queries, also blocking nuisance source IPs

Backend network is 2.5Gbit via a TPlink Omada switch.
I do have a couple 10G connect links to the hosts supporting the VMs, but 2.5G for the rest of the network, & running over a consumer 1000Mbit NBN connection.
Unfortunately Australia doesn't have affordable syncnonous multi gig internet connections.

There are other internal only hosts & VMs the internet doesn't need to know about :-D
I do run internal 3d (actual primary) DNS, NTP, NAGIOS (host monitoring) for example.