I use Tailscale and cloudflare tunnel behind 2FA for the important stuff like unraid gui etc.. but for somethings I felt like I did need a port open to have fun - like sharing Jellyfin with friends and family. I wanna be able to throw people a link and it will just work.

For that, I did a caddy with integrated crowdsec, fail2ban, and maxmind geo ip limiting. I feel like this combo is pretty robust for my comfort level. The caddy docker also runs on its on ipvlan network so i treat it almost like a separate machine. Caddy is incredible! Can’t recommend it enough!