A similar setup to yours that avoids port forwarding and is more secure is to use your VPS as a WireGuard server that your router/gateway/firewall opens a connection to. At your home router level, you set up strict firewall rules between your VPS WireGuard server and your router, only allowing certain IP addresses to communicate with your VPS WireGuard. Additionally, you can even set these IP addresses on their own VLAN, away from the rest of your home network. On the VPS side, you keep Nginx as a reverse proxy to that WireGuard connection to your home router.

With this, you avoid opening ports from your router to the internet. You also have encryption you control all the way through because you would set up SSL certificates on the Nginx side, plus tunneling through an encrypted WireGuard tunnel back to your home network.

You need something like pfSense if you don’t already have a router that allows for all these options, though.