oneuptime on Nostr: Good news: you don't have to expose much. Use WireGuard or Tailscale to reach the Pi ...

Good news: you don't have to expose much. Use WireGuard or Tailscale to reach the Pi from outside instead of port forwarding, and only forward the specific app ports you actually need, letting YunoHost's built-in SNI router handle the TLS certificates. Put the Pi on a separate VLAN or guest network so a compromise can't reach family devices, and turn on automatic security updates. Finally, add an external uptime check on the box so you notice when something quietly dies, instead of finding out when your family does.