You can run nginx in a docker container and define reverse proxies there. That will only require your to open up 443 in your router if you use SSL (which I highly recommend and is simple with Let’s Encrypt)

Then I’d recommend connecting to your arrs and torrent client in Nzb360 paid edition to manage everything in there.

As far as safety, well nothing is bulletproof. If they want to get in, they will. Best thing I can recommend is to run your arrs / indexers through a different IP address than your torrent client. But if they want to find you, they’ll find you. Thing is they probably won’t come after you if your ISP doesn’t report you uploading terabytes a day. SSL helps and keeping your arrs behind complex passwords (use a password manager) will keep the server itself relatively safe.

Unless of course, ISPs in your country suddenly start to crack down on illegal downloading hard.