bezoar

Why downvoted? This is what i do and it works well.

If you use tailscale you can omit the raspberry pi and tunnel directly from the reverse proxy to each server (could do this with wireguard but requires a little more setup). Also you can configure your cloud server as an exit node so that all traffic from your device go through it, sort of as a vpn service. It's not as anonymous as a paid VPN service but at least you bypass the ISP or local wifi provider if you're out and about.

Our family uses Humhub. It's pretty similar to Facebook and installation/maintenance is pretty easy. The only issue would be that there's no mobile app, however it works quite well on mobile browsers.