I have a lot of stuff self-hosted.

Just no outside access. Well, that’s not quite true, I do have a Tailscale VPN for remote management, but only certain machines are allowed to join, joins require my authorization, and access to the account is via two-factor.

The big thing with external access is to never permit it directly through your local connection. Do it though a Virtual Private Server (VPS) - let it get hit with access attempts. And then only allow specific traffic from the VPS to a specific service in your network using a VPN of some sort.