Hi,
I need a device (router or also other devices) that have at least:
4 gigabit ports
1 USB port
Wireless not needed
Modem not needed
It should be one where I can flash the latest OpenWrt without opening it phisically.
I need to install on the device Apache (with TLS 1.3 support) on port 8080, PHP 7.2 (if possible 7.3) and an SQL server.
I need to setup my custom root certificate on both the device interface and on Apache.
I would like to have suggestion on good devices that can do it and on Apache/PHP/SQL setup.
That would most likely be a device that runs a full blown distro of some kind as at least Apache is a bit broken on OpenWrt and the only databases packaged are Maria and SQLite (you "propbably" want Postgre or something else). I think you wont find it ideal to keep track of security updates as there are no facilities at all apart from the uscan site and due to the fact that updating packages is far from ideal but that's more or less a design choice given the targeted devices.
Some general advice:
You probably want at least 2Gbyte of RAM, you might get away with 1Gbyte but it will most likely be an issue further down the road but it will do if you have a fairly low traffic/non intensive site you might get away with just 1Gb.
You most likely want storage attached via PCIe (SATA controller) rather than USB due to reliability concerns. If it's a fairly low traffic site you might get way with USB.
You should probably go for 64-bit as that's pretty much where "all" are headed
Marvell and Allwinner have by far the most "mature" support in Linux/BSD, RK3399 is looking good but it's not there yet by quite a margin if you're looking at mainline.
Given the above this severly limits your choices and becomes a matter if/what you can compromise.
The closest you'd get is a ClearFog GT 8K which checks all boxes, SATA needs to be provided by miniPCIe card but that's a very easy "fix". I don't know how well it's supported in mainline/BSD yet, especially the switch however.
A rather well supported board is the MACCHIATObin which is very similar but no integrated switch so you need an external.
...going further down the line
Espressobin 1/2Gbyte versions (only eth 3-ports)
PINE A64-LTS (1-port, eMMC available)
I can only personally say that as far as I've tested full grown distros that FreeBSD works surpringly well as its pretty much flawless (for me at least) using a Orange Pi PC (Allwinner H5) which is more or less the same as PINE A64-LTS but with only 1Gb of RAM and without eMMC. You will need to run -CURRENT more or less which may sound nuts but it's very solid (and Netflix did a talk about it since they use it in production) however I'm not sure of the status with eMMC. It's also recommended as you're running -CURRENT to either run Poudriere or selfhost (I do this and it's doable with 1Gb of RAM but it's painfully slow so I would only recommend this on at least 2Gb devices). You might also want to checkout ArchArmLinux, Armbian and Alpine.
I know work is being done of both RK3399 and A8040 but I don't know the current status of those.
So in conclusion, you need to do some research about the board you're looking at and be prepared to run "bleeding edge".
The majority of ARM boards (yes, that's your best bet) doesn't come with software preinstalled.
If you want to evaluate the performance characterists of ARM I'd suggest that you try Scaleway first unless you're willing to grab a board.
If you're unsure, just grab a SFF x86-based system.
Basically you want to keep router/ routing functions and the webserver separate for security and maintenance reasons alone, at least if the webserver is supposed to be accessible from the outside (or untrusted parties on the inside). That also makes choosing the best option easier, as devices with high CPU performance/ RAM don't necessarily have the best I/O options - and the reverse as well. Depending on your expectations a 'cheap' ARM based SBC might fit the bill for your webserving needs, even though they generally suck as router (not enough ethernet ports, not reaching full 1 GBit/s linespeed, bad wlan options - but everything necessary to be a good webserver), but entry level x86_64 shouldn't be ignored either.
It's going to be more complex as you have no way of tracking vulns and there's no facility to update packages (at least timely) unless you plan to host your own package repo but if you don't care about security go head.
Also, you might want to keep some statistics of some sort which you will need to port yourself like AWStats or GoAccess (might not be ideal on ARM however) or some security modules for PHP/Apache.