Only downside with hetzner storage share (compared to other managed hosting providers) is, that you need to run your own collabora instance on a VPS to use nextcloud office And ffmpeg isn’t available on most managed hostings

Running SSH on a non-provileged port brings new issues. And using 2222 doesn’t bring any meaningful security by obscurity advantages.

The rest of the options look nice. It would have if there would be explanations on what the options do in the example configs