My experience is, that if you have enough money, it is better to split the jobs. I have Synology NAS, Synology router, and mac Mini for living room TV service (flexible & expensive “apple tv”). I split all jobs you list above among these components. NAS provides file and media services, backup place etc. Synology can do all of that nicely. Synology router provides vpn and other network services. No need to expose NAS more than needed to outside. And living room mini has autologin account which serves all media needs (VLC and other players), browsing, messaging, and has copy of the Photos library. This mini is backup to NAS. It is quite expensive, but distributed and so you do not necessarily take down everything when maintenance is needed. Have you tried to troubleshoot VPN when your wife wants to watch movie? Guess who wins…
Back to your problem. I think it can be done, but will always be bunch of compromises. I would split the job to different hardware. Some services – e.g., vpn – could run on Raspberry Pi which is cheap and easier to maintain when needed.