Comment by imhoguy

Not GP but may be helpful to someone: I wouldn't expose any home-net service to the Internet except Wireguard VPN. It listens on connection-less UDP and only responds to clients with recognized auth key. On the router you just forward UDP port to the machine with WG. There are clients for Windows, Mac, smartphones.