raspberrry pi in home-network DMZ, with fail2ban, unattended-upgrades, and a free dynamic DNS service gets you most of this. (plus, you're root, so you can run things more complicated than web-services)