now the real fun part is how to self-host it on a machine accessible on the net without services like cloudflare or tailscale tunnels.

Fixed IP would be a way to go. Some people pick dynamic dns server so they can periodically update if their IP changes. But IMO it's just too complicated. I don't think there's a good way to go around ISP restrictions, especially in USA.

I host my site on my own home server, but I do have a proxy ec2 server to tunnel public traffic via wireguard back to my home server. This keeps things a bit more protected and my router/home network not directly exposed. I'm also not locked into AWS, I just use them for convenience, but could get any other cheap proxy to run wireguard. No dependency on tailscale either, it's just nicer interface to wireguard. Wireguard config is like 5 lines btw.

It used to be as simple as getting a fixed IP but these days that is indeed a lot harder to get.

You can do it over TOR.