The single best thing you can do security wise, is to NOT have any personal data on a web facing server.
Separate the data
Rereading it does look like you are doing the things right; so just audit what is on the public side. - your calendar and tasks- cool
Your photo and docs, do those need to be on there?
they are not accessible on the WAN
If they are on a server that is publicly accessible, please move them to a different location
Otherwise you sound like your doing well
Gosh I’m sure that this will be some dangerously delicate process that will be too hard for me…
Oh. Cool.