I have the first 3 points covered with resilio sync, wireguard, and running ZFS on a Linux district with full disk encryption. I would have all 4 if Linux supported newer fingerprint readers