questions on setting up a Buildbot

See section 8, it refers to Debian Stretch, so a bit more up to date and as far as i can recall there were no major changes.
Do you have a public IP address?

That might work, i never used dns services, just a public IP, but this does imply having a good firewall or things go sideways very quickly.
Seems you have a Team Fortres server running on the same machine, if that is the case, that is a big no no.
And i absolutely will not use virtualisation anything ever, just a plain server install, i am old school.
It makes a mess with open ports and hardware voulnerabilites are plenty.
But you are hidden behind the DNS service, so that is good.

rodw wrote:

BUt there are plenty of cheap 4 x NIC PC's in China you could run pfsense on to achieve this.

This is by far the best option, although any old PC will do just fine for this, two NIC's are good enough but having more leaves possibility of having separate local networks, or even load balancing on the public side.
I also absolutely avoid using of the shelf firewall/router, anytime there is an issue/vulnerability the manufacturing company takes ages to post updates (they are busy trying to cover it) so all that time it leaves the server open to anyone who bumps into it.
Just to be clear, i am saying that the home made old PC firewall is much better than the ones costing $10000, and by a huge margin.