Yes, always use HTTPS, even on local networks if there ever are more than one device on the network.

The way to handle services with/without HTTPS is to put everything behind a reverse proxy that automatically handles certificates. Since you’re using NGINX, you can try setup certbot, or switch to something like Caddy that has certificate handling built in. If you have all your Docker containers on one server, you can look at Traefik.

One could fairly argue that maybe such people shouldn’t have access to a system, but it is a reality.

More that, such people shouldn’t be allowed to be sysadmins, yet self-host and/or expose any ports to the internet.

Also, side note: Regardless of where you switch to, get your own domain! I cannot stress this enough. If you ever need to switch providers (which you’ll eventually need to), you’re gonna have a much easier time if your email is me@mydomain.tld, just pointing DNS at your new provider, bulk transfer/export all previous emails, and voila.

Well, that’s it, I’m never touching Proton again.

As for suggestions: I haven’t used Tuta, but I’ve only heard good things about them. Personally I use mailbox. They have drive and calendar, they’re German, and they do/support a lot of cool stuff regarding FOSS. I’m not sure about slop, but from a quick glance I couldn’t find a single mention about AI on their website, not even in their job listings. I don’t think they have official clients, but they support open standards like SMTP/IMAP, WebDAV etc.

I haven’t used their drive and calendar though, only email, since I self-host Nextcloud (if you’re into self-hosting, I highly recommend it).