Your existing Apache setup can be used as a reverse proxy. The idea is, you setup those other services (eg, next cloud or radicale) on other systems, or on the same system with different ports. Then when you access some URL, eg yourhomenetwork.com/radicale, Apache acts as an intermediary and returns the service at 127.0.0.1:8080/radicale. No additional open ports needed. No additional certificates needed.

Apache can even be configured to respond to requests differently if they’re coming from the internet or from wireguard. Say if you wanted to deny all traffic from the internet and only access it from your VPN, or if you wanted to conditionally apply a password.

You can also use Apache to host multiple domain names, or sub domains, from the same IP address and ports (the feature is called “vhost”). That would require multiple SSL certificates though.

You’ve got options though, and you don’t need to break what you’ve already got :)