VPN: Headscale is an open source, self-hosted implementation of the Tailscale control server, which itself uses WireGuard under the hood.

For the file share, i’d say separate into two groups/VMs probably.
Whatever you might want to self-host publicly (are you sure?) keep it isolated. Its own VLAN, IP/host/subnet, container, VM heck its own hardware if possible. Or use a VPS and only self-host your private stuff in your LAN.

For what you should host: that’s up to you. I’ve heard jellyfin’s used a lot for media stuff.