A basic way to head off most of the security issues is throwing it behind a VPN (eg: wireguard) - no need to put stuff on the public internet if it's just for your own consumption. You can still include your mobile devices etc.

Separately I think k8s is a solution to much of the difficulty. I don't use it outside of work as the baseline costs are too much (my personal cloud bill is under $10 and I want to keep it in that range), but the packaging offered by well maintained helm charts is hard to pass by - people dunk on it for being complex but imo it only exposes inherent complexity and simplifies a lot of other stuff.