For the GP's DDOS concern, you could just expose the service through a Cloudflare tunnel or something.