If your vps is a firewall, you could use it as an exit point for different private networks: ip1 to mask the traffic for a guest subnet that you don’t trust and if the ip gets blacklisted there are no issues for lan traffic behind ip2 while ip3 is reserved for server traffic with specific rulesets on supplier’s systems for updates/backup/whatnot. Should you have more than one mail server because of reasons, if one is blacklisted the other could remain clean (in this situation you usually put them on different subnets but whatever).

Mailu is a mail server so it is suitable for the task.

You need a mail server somewhere, a mail client cannot listen for incoming messages. A possible workaround: you could activate your own mail server accessible only inside tailscale and use it to send and receive your local alerts.

I’m doing something similar with an android tv, a raspberry 3a and my home wifi network. Antenna hooked to the raspberry using an usb dongle, tvheadend on the raspberry and kody on the android tv placed wherever you need it. Also added clipious on the tv to have no ad playback. I don’t need surfing so my setup is simpler and everything is controlled using the tv remote. Once you have the pi up and running, the bonus is that you can find a client to connect to tvheadend for any platform, so you can watch tv on a smartphone (android or apple), a tablet, a computer, another tv in the basement…