The only port I open is for wireguard. That way I can access all services on my LAN. Wireguard is also very secure and requires keys based authentication so is hard to brute. It also allows me to secure myself if I ever need to join WiFi or an untrusted network