Most of the solutions I've looked at utilize Roundcube in some form or another. It looks like exposing Roundcube to the internet is a really bad idea. I guess I'll need to restrict Roundcube to VPN-only or something like that.

https://cyberinsider.com/data-breach-at-cock-li-email-service-exposed-over-1-million-user-records/

I'm just first looking at all of this. There appear to be many security considerations, and when I finally do pull the trigger, its gonna break my existing ImprovMX email forwarding, so I'm in no rush. When I'm done, I want email and nextcloud running on the same server, pretty much forever, so I want it done right the first time.

I've not heard of mail in a box but I'm using Mailcow myself. They have a full docker compose and update script that will tear down and upgrade the stack itself. Been using it for years with little issue.

It's a good thing you have a mail forwarded already as you risk getting immediately grey listed without one for outgoing mail. I'm using SMTP2Go myself and it works great. They have a free tier that works for very little volume outbound. I may need to see about moving to ImprovMX if it makes sense to do so.

My use case is basically for internal system alerts and testing for work mainly. I don't want to rely too heavily on my internal mail server because if it blows up for some reason, I don't want to have important information in it that could be costly (time consuming) to recover.