Chiming in with some post-hardware-acquisition suggestions.
Read up and learn about docker and specifically docker compose. My reverse proxy of recommendation for a beginner is Nginx Proxy Manager. Debian stable server releases are great distros for your use-case.
Use least-access thought for connecting services and networks. For example only jellyfin and jellyseer needs to be on the NPM external network definition and accessible over network, not the underlying *arr stack, VPN, and torrent containers actually searching/acquiring the data.
NPM
- proxy-network
Jellyfin
- proxy-network
Jellyseer
- proxy-network
- arr-network
Radarr
- arr-network
- torrent-network
Sonarr
- arr-network
- torrent-network
QBitTorrent
- torrent-network
Containers are addressable by container name:port if they're within the same network so you don't need to worry about finding a container's specific IP address. Example: when wiring up the Sonarr service's location in the Jellyseer UI, assuming you named the Sonarr container Sonarr you can punch in Sonarr:7777 [this is just a random port for the example] and that Sonarr will resolve to the correct local IP in their shared network (arr-network in this example).
Also on the hardware side get a GPU with hardware AV1 support (the new Intel GPUs are great and cheap for this) as that's the go-forward video codec and you'll save tons in power on transcoding and an absurd amount of storage space over h.264 and a decent bit over h.265. It's also worth updating clients with hardware decoding for AV1 asap so that the server has to transcode less as well (recent fire sticks and new TVs within the last 2 years should handle this already)
Also forgive me if this is all stuff you know already but also enable only key-based ssh access kinda immediately as the amount of port sniffing you'll get on 22 is absurd.