I have a cheap VPS which is facing the internet and runs a reverse proxy. It’s connected to my home server via Tailscale and routes everything to the services on my homeserver. So I only expose http ports and also rely on the DDoS protection of the VPS provider.