Firewalls, containers, separate subnets (or VLANs if possible), VPNs.
Keep really public stuff in a VPS though, and the private in your home server. Connect them via wireguard (using e.g. headscale).