[hansr]

You are correct that a CGNAT doesn't give you a unique IP address, and you have no control over port forwarding. My ISP put me behind a CGNAT right while I was working on adding letsencrypt support to ZitaFTP Server (which requires the server to be internet accessible). They would have given me a static IP address if I paid them a lot more...

The solution is a tunnel between your machine and an external server with a static IP address. The external server will forward requests to your machine.

Cloudflare tunnel is an option (thanks watchdogtimer), and there's also a service called Ngrok. I took the most complicated option: setting up a reverse ssh tunnel to a VPN that I already had.