I use Caddy with Authelia and Caddy MIB. Anything that I need access to is exposed via reverse proxy with Authelia infront of it. That sometimes mean I have to login twice. Caddy MIB makes it so repeat offenders are blocked for longer and longer. Prevents brute forcing stuff like Jellyfin.

I am considering using Tailscale (or Headscale) because I could combine that with Mullvad VPN and still have my internal DNS. But I only have one server and I have hairpin NAT configured so I just enter my domain name inside and outside of my LAN and it just works^tm^. I also considered using Traefik but Caddy just just works^tm^. Only problem I had was with Dawarish needing brotli encryption, I had to create my own docker image (and then I automated keeping it up to date with Woodpecker CI and Renovate).

All in all, I like the reverse proxy route.