Exposed is the right term. Other than my Wireguard VPN port, everything I have exposed is HTTPS behind Authelia MFA and SWAG.

I'm tempted to switch Wireguard for Tailscale, as the level of logging with WG has always bothered me. Maybe one day.