I have been building a private cloud for small businesses for last few months. Like the OP, I'm also behind CGNAT so I have to use a VPS to expose my services.

For running services, Incus, particularly IncusOS has been godsend. Clustering, containers, vm, networking, storage, monitoring; so much is streamlined. I put an OpenWRT router(using a Pi 4) in front as the internet gateway that handles DNS and Wireguard with the VPS. For configuration management, I'm using justfile and a bunch of shell scripts.

[dead]