Nginx is easy to setup as WebDAV server.

All his files are secure and properly synced… unlike Nextcloud.

Spamassassin is useless these days, you better be using rspamd.

https://workaround.org/ispmail-bookworm/catching-spam-with-rspamd/

You can force all outgoing traffic to use the VPN interface via iptables/routes (meaning if it doesn’t exist or doesn’t work nothing will be able to access the internet) OR use systemd globally hide the non-VPN network interface from all services except for the VPN client.