Personally, i would use VPN, Pihole for Local-DNS Records and a simple Local Reverse Proxy to address my Network-Services. I wouldnt open anything from my Homelab to the Internet.