Personally, I switched from Mullvad after they dropped support for port forwarding. I’ve found AirVPN is easier to use on that front as well.

You would, but that’s where your firewall and SSL certificates come into play. I use a reverse proxy and forward port 80/443 directly to it. Everything I host resolves to a CNAME in Cloudflare and my proxy responds with a 404 to any unknown requests.

Yes, but by proxying your traffic via cloudflare your domain will point to their IP instead of yours directly.