For strictly personal stuff, like my home network, isolate behind a router to block all outside traffic. Then install a VPN on your home server so that you can remote in via a tunnel. I use TailScale's free tier and its great.

If that is not good enough then do the same as above but lock everything behind PKI certificate access and make all your home services accessible only via mTLS. This is huge pain in the ass, but you are that paranoid you get what you pay for in your time and effort.