Okay, so that’s pretty much the setup I had in mind. Good to know there is not much need for an extra step for security, thanks for the answer !

Well, I guess that would still be vulnerable to DDOS attacks, but that would just prevent me from accessing my cinnamon apple-pie recipe from my self hosted recipe manager for some time. A bit mean, but not catastrophic.

I wondered if there would be some other attacks that could compromise my machine with only a wireguard setup, but that’s a good sign if there is nothing obvious.