hansr

I like the sound of this. The last time I set up my own email server, it was a nightmare.

True. Is there a Content Delivery Network (CDN) that isn't a MITM, though? Sitting between the client and server is how they work...

You are correct that a CGNAT doesn't give you a unique IP address, and you have no control over port forwarding. My ISP put me behind a CGNAT right while I was working on adding letsencrypt support to ZitaFTP Server (which requires the server to be internet accessible). They would have given me a static IP address if I paid them a lot more...

The solution is a tunnel between your machine and an external server with a static IP address. The external server will forward requests to your machine.

Cloudflare tunnel is an option (thanks watchdogtimer), and there's also a service called Ngrok. I took the most complicated option: setting up a reverse ssh tunnel to a VPN that I already had.