Alternatively, gather the IP addresses of family and use your reverse pretty to restrict some subdomains to that trusted list of IPs.

The downside is that when someone’s IP changes you have to update. Make sure you track which IP belongs to which person.