Get a cheap pcie 1Gbit Intel NIC from ebay, cheap switch, Ethernet cables.
Throw the NIC and proxmox into the SFF, make a VM for OPNsense, use the switch downstream from the SFF. Get the NAS and laptop onto a separate LAN firewalled from the ISP.
Set up another VM in proxmox for a workspace, connect it to the NAS file shares, do the same with the laptop. Set up syncthing on laptop, workspace VM, and the NAS if it supports it. Make a keepass database, start organizing all logins to keepass, keep everything synchronized with syncthing.
Set up tailscale, add it into OPNsense to allow easy and secure(?) remote access into your subnet. (I use tailscale, but don’t trust them much and want to switch away.)
Its very daunting at first, but this is the path I took, not really a guide. All this will take a few days of constant effort to get right, but you absolutely don’t need to do everything at all once, just a slow migration. I’ve been slowly building mine up for about 5 years now, and there is no one “right” answer to anything.
Only move forward when you get comfortable with each step. I personally run everything from a stack of thin clients I got from some kid off Craigslist. Think they came out of a bar and grill, filled with grease and cigarette tar, but they cleaned up nice. A full Arr stack with jellyfin runs great on an Intel 6500t with 16gb DDR3 ram.
Slowly get comfortable with the CLI and general security updates, next thing you know you’ll have 3x smart switches, better/faster NICs for the proxmox box, a WIFI6 AP for better throughput. Its endless. I try to focus on minimal wattage, my full stack pulls a steady 80 to 100 watts 24/7. You’ll get a “gut” felling for what runs best on what hardware. I spent too much on Raspberry Pi’s in the past, should’ve tried thin clients sooner.
Aye on the notepad. Everything but passwords, every change gets a journal entry.