Hello Graham
For one client, a doctors practice, I’m using virtualization on Proxmox, NethServer is running as AD, File, Print, NextCloud, Zabbix Monitoring.
The doctors application is running on a Windows 2019 Server, virtualized.
Exchange functionality is provided here with a Linux LXC (Linux Container) with 6 GB RAM allocated and running Kerio, a full replacment for Exchange, including Web-Access.
Besides the not very open source PFsense, you might want to have a look at OPNsense, a (better) fork of PFsense. PFsenses mentality is $$$, not open source. OPNsense has a more modern GUI and includes more than you expect! I wouldn’t touch PFsense with a long pole!
I do not use the built in firewall for my clients (Almost all use OPNsense), but two friends have it running as home server, one uses the NethServer firewall. His real firewall died somewhere between Xmas and New Year 1.5 years ago, and getting replacements in that period was difficult. So a quick help to allow Internet at home has stayed and still works.
BTW, all my other clients use NethServer as SBS replacement, WITH Mail, Calendar, Adressbooks and more!
Most of my clients do not want “Cloud”, indeed for certain businesses (financial) it’s illegal in Switzerland.
My 2 cents
Andy