Plus, the internal and external services are running on the same box. Is that where my real problem lies?

It’s one of them, yes.

If you want to limit exposure in the case of a compromise you need to put everything public facing in it’s own vlan that cannot initiate traffic into your lan.