Only public facing ports, maybe your openvpn login. But that means you are already firewalled up and your attack surface is tiny, good 👍

I recommend fail2ban to stop the automated attacks that are the background noise of the internet. It will set your firewall to block certain ip’s for a while, especially ports 21/22 are getting hammered with dictionary login attempts. And port 80 and 8080 for example get constantly version checked to see if you are vulnerable with an old apache, old dokuwiki etc, so don’t expose more than you need to and maybe learn about ssh tunnels and close a few.

I once installed ossim in a small network with a server and it showed me it is war out there, scripts flying everywhere.

CES is next week, unless you get a really good deal, this is the moment to wait and see how the market will shift this year. As for your performance question, I recommend the relative performance table at the bottom of your current gpu’s page: https://www.techpowerup.com/gpu-specs/radeon-rx-5700-xt.c3339

Lack of ads. And I mean that in a transparancy way, people are going to promote stuff (‘look at this cool project i’ve been working on’, ‘someone needs money in this crowdfunding, after i tell you this long, heartbreaking story’) it would be nice to see markings if a post has a direct benefactor and who that benefactor would be, to decide early if you want to engage.