What is the issue with the external dependency? I would argue that consumer routers have near universal shit security, networking is too complex for the average user, and there’s a greater risk opening up ports and provisioning your own VPN server (on consumer software/hardware). The port forwarding and DDNS are essentially “external dependencies”.
Mesh VPN clients are all open source. I believe Tailscale are currently implementing a feature where new devices can’t connect to your mesh without pre-approval from your own authorized devices, even if they pass external authentication and 2FA (removing the dependency on tailscale servers in granting authorization, post-authentication).
As others suggested you don’t need all your historic mail on your mailserver. My approach to email archival is the same as all my historic data — a disorganized dumping ground that’s like my personal data lake, and separate service(s) to crawl, index, and search it (e.g. https://www.recoll.org/)