Before doing anything else , consider if you actually need to expose anything to the internet at all. Running a VPN would let you reduce your exposed service to 1 port ( wireguard is UDP based so it’s harder to test if the port is open too ). A VPN like NetBird / tailscale / Cloudflare warp don’t need you to open any ports at all

Good advice! Here’s my setup in more detail:

• a good 90% of my services are “private”, i.e. they’re only accessible through Wireguard or from the LAN. I use local DNS + a reverse proxy to get “virtual” URLs + proper SSL termination within the LAN. Also, all administrative tools (e.g. SSH) are private (Wireguard or LAN only); none of them are publicly available.
• some of my services (e.g. Nextcloud, Wireguard, RustDesk) are public so as to allow me to use collaboration and file sharing tools with others. For this I do expose some ports publicly.

As you can see, I have mostly realised what you said. However, I don’t see myself setting up VPN connections for each and every user of my services and train them how to use them; link shares via Nextcloud or tech support via RustDesk need to be frictionless, so taking these services private isn’t an option.

Yet if one of these public services were to be compromised and root access gained, I do see the risk of a (motivated) attacker to attempt lateral movement to get at the more sensitive services that I’m keeping local for a reason.