This might help

https://blog.pishop.co.za/using-a-raspberry-pi-as-a-bluetooth-speaker-with-pipewire/

Your response clearly states publicly accessible DNS. A CA does not require anything public for local SSL and can work in conjunction with whatever service they want for that which is public.

public domain for internal services

I guess they need a CA then

https://smallstep.com/docs/step-ca/

https://www.freecodecamp.org/news/docker-nginx-letsencrypt-easy-secure-reverse-proxy-40165ba3aee2/

Raspberry PI

Amen

The fractal Terra is small but not stackable; easy access to everything but sata drives. In the past I used a Sugo 13 but the psu takes up most of the space.

Lian li and Asus have some good micro atx options like the tu150 or the ap201. Overall small compact machines that stack are best suited to 1U/2U rackmounts in my experience

The cost of doing business means you should buy a license for each user that needs an account.

https://www.linode.com/community/questions/22605/can-i-set-up-a-smtp-relay-server-on-linode

I have mine setup on a Supermicro itx-based machine with an Intel n3710 and 8G of RAM. It has four Intel-based ports but you can easily get away with two.

I used to run a Zotac ci323 with dual Realtek nics. Works fine for 300M up/down.

You’ll want two ports, one for WAN one for LAN and most nics will support VLANs if you need more than that. Any VPN or encryption will increase your cpu requirements. If your needs are low a cheap dual-nic Nuc like device works great.

depending on your use case these are cheap and cheerful.

https://www.newegg.com/sapphire-radeon-rx-6400-11315-01-20g/p/N82E16814202416