[imhoguy]

Not GP but may be helpful to someone: I wouldn't expose any home-net service to the Internet except Wireguard VPN. It listens on connection-less UDP and only responds to clients with recognized auth key. On the router you just forward UDP port to the machine with WG. There are clients for Windows, Mac, smartphones.

[thomasjsn]

Good advice, this is what I do. I expose a few services on HTTPS, behind a reverse proxy. Everything else is WireGuard.

[jpe90]

That’s super helpful, much appreciated!