I don’t technically open any ports to the public. I have a site-to-site wireguard tunnel to a hosted server. The hosted server is running a hypervisor with two virtual switches. One switch is my external switch and only my Wireguard server is using it. The other is a internal switch where I place other VMs for separate things. A container host, a terminal server with xrdp, a monitoring server with netdata, stuff like that. All technically, but unnecessarily, accessed through nginx proxy manager.

Because it’s site2site with my home equipment on the Wireguard server, i can still connect to my home network where i host a number of separate services like HomeAssistant from outside the home network.

I don’t use tailscale, but Wireguard vanilla is super easy to work with. I also have fail2ban practically everywhere I can install it because it takes up practically 0 resources.