Sorry, didn't see you mentioned unraid already, but you are right on flexibility
Offtopic: I use the cpu for plex transcoding on mine, and use the 2060 gpu in a vm for vr stuff. Eventually I'd liek to try setting up a wireguard thing for when Im away to access the files. Or I could just stick to parsec and remember to turn the vm on before I leave for a long trip
Edit: quoted the wrong person lol
I ended up moving my Plex install from docker to the VM for acceleration, I mounted my media share as a read only network drive in windows.
I use Unraid’s built in Wireguard, only real pain was configuring my Firewall. Might be worth checking your router first to see if it has a built in VPN as that may be easier and offer more resilience.