True, maybe the best way then is to expose them only within your Wireguard network.