Tunnel is fine security wise. Keep the reverse proxy anyway and let the tunnel point at it. Routing, logs, etc. stay in one place this way.

Zero Trust with Google etc. is the way for family. Tailscale or Wireguard means installing a VPN client and making sure it keeps running, that’s too much for most people who just want to click a link.