Make sure everything is behind a VPN, like tailscale. Then you setup your router to only forward the tailscale ports, and that will be the only possible attack vector

As long as tailscale is safe, you should be safe