VPN only, nothing exposed, the host runs openSUSE MicroOS which updates itself daily, all the containers get updated daily by Watchtower and if something blows up so be it, except for Nextcloud as everyone says it’s brittle as hell.