I have several services exposed and I am using cloudflare since I have starlink and traefik as reverse proxy paired with crowdsec via a plugin. Works nice. I have not tried exposing immich yet though, that can only be reached via VPN.