Your really need to define your scope first. Is it just you? Family? Extended family? Strangers?

After understanding that, the best bang for your buck is a private mesh/tunnel VPN. Tailscale, Netbird, Pangolin, or plain wireguard. If you want real public routing, then you need to understand reverse tunnels and your app’s lifecycle/quality. After that, all the security guidelines are basically trying to reduce blast radius. And that depends a lot on how you’re running the app, what it has access to, etc. DMZ network for isolation goes a long way.