I want to set up a file server (NAS) and possibly provide other
services than that (DNS, VPN perhaps) and I would like it to be
accessible from an external client (FTP, SSH and such). What do I need
to consider/change to make this happen hardware/software-wise?
Assuming you mean from a networking standpoint, you need a NAS device which would provide those services... This portion of your question was unclear. Generally all that is needed is some simple port forwarding in your router, such as port 22/TCP for SSH in your router would be port forwarded to the static IP address you would router to your NAS device. Note that this usually not the best way to accomplish this from a security standpoint, using a VPN client is usually preferred even in a home network. Be aware that many routers have the ability to provide VPN services or act as file servers to both internal and external clients securely. ASUS is a common example I am familiar with, but there are others.
Is this the optimal structure for my home network? Is it not better to
remove the router/wireless part from the cable modem, and only use a
cable modem which simply converts every signal from the
This is purely my opinion, but no it is not "optimal". My experience has been that cable modem/routers supplied by the carrier are not the best. In most situations it is better to get a good, quality wireless router (ASUS/Dlink/TP-Link/etc) and use a dumb modem in bridge mode. Also, optimally you want to have as many clients and devices as possible with a wired connection rather than wireless, but that doesn't seem to be a part of your question.
Does a simple cable modem have an external/internal ip-address, or is
this set by the wireless router in the diagram?
No, a "simple cable modem" is just a bridge device at layer 2 from all practical perspectives. Most modem/router combo units supplied by cable companies can be put in bridge mode though, and act like a "simple" modem. This simply converts the networking signal on the coax to an Ethernet medium you can use, passing through the public or Enterprise-Grade NAT address that is supplied by your ISP (effectively, it is a little more complex than that but it isn't relevant to this answer).