They set up a business. They do business. They should ask someone to do this whose business it is. Not you. They are taking advantage of you.
You will certainly and 100% ruin your friendship with them.
Keeping a server secure is an ordeal for a professional - especially when it comes to using it as a business server.
Doing E-Mail yourself, especially in a professional capacity, is a god damn nightmare and even most professionals refuse to do it and rather pay someone who handle it. For a reason.
The usecase you mentioned does not require a server. It can easily be done via a web hosting provider. Unless there is something shaddy going on and you/they are afraid of storing that stuff with a provider. But for what you mention here you need a simple web hosting provider for 5 bucks a month.
Actually doing that yourself is far more complicated than you imagine here. It’s not just the server. How do you get a connection with a static IPv4 to host your services? Actually preferably multiple static IPs? Are you considering a CloudFlare tunnel? How do you plan redundancy if that connection craps out? Or the server kicks the bucket. Or power goes out? This alone costs FAR more than the money you pay for a cheap webhoster or even a VPS. (Which you don’t need,imho)
For the love of god or whoever: Don’t do that. You will be liable/responsible to them (at least from their point of view) if their IP is on Googlemails blacklist and now “that one important client mail did not arrive in time”. Or if the cheap residential DSL craps out and their very important site is just having the sale of their life?
I am absolutely for self-hosting things, don’t get me wrong. I selfhost basically everything (but no mail…that is a shitshow), mostly on FOSS. But don’t start with someone else’s business if you start doing this. Selfhost a few easy things. Get a Mini PC and proxmox, selfhost within your home network, then expand slowly.
OPNsense on any small scale dual LAN box, either a used mini PC or a purpose made one.
LG is currently even worse than Android - it autoinstalls (gambling!) Apps(yes,we made sure there was no hack/malware), tries really hard to get into the network, etc. But I might be biased as I am very unhappy with their support as well - their display showed a faulty line exactly 10d after the guarantee/warranty ran out, they quoted more than the current retail value for the repair and 80% of the original retail value. For a problem that is very likely not even the display itself but a faulty cable. Fuck them.
Personally, if a Pi is out of the scope (which I totally understand) I would go with a Android box and any TV you like displaywise- while Android is as bad privacy wise as any other TV OS nowadays, it is usually far easier to lock it down at least partially so at least the worst problems can be avoided/most of them can be rooted or get linage OS installed. Just make sure the box you use can do that.
Because in the end it’s also an usability problem - your parents will call you if Netflix, Disney+ or something like that refuses to play because they now require widevine in a newer version than LibreELEC offers,etc. If you want to support that, go for a Pi. If you don’t, find a middle ground.
It sounds strange maybe,but I found Zabbix way easier for these scenarios. For more advanced deployments it is different,but for what you describe it is really easy