Yunohost provides good set of tools to secure home server (Fail2Ban). Additionally, I use SSH on different port and with pubkey authentication. My Nextcloud instance uses geoblocker and 2FA. I am waiting for 2FA for Yunohost SSO (it should be added in Yunohost 11.x)
It is good to not make all apps available in open way. I have some of them hidden with Yunohost SSO system. I do not host apps, that can be used anonymously, for example copy-paste tools or Nitter.
Not all routers provided by ISP support port forwarding. It can be locked for you. If you have normal IP address (even dynamic) you should be able to open this ports. My friend had to call his ISP and ask for opening the ports. Another way is to buy second router and use first router in bridge mode (which I do, because I started using OpenWrt).
Yunohost provides good set of tools to secure home server (Fail2Ban). Additionally, I use SSH on different port and with pubkey authentication. My Nextcloud instance uses geoblocker and 2FA. I am waiting for 2FA for Yunohost SSO (it should be added in Yunohost 11.x) It is good to not make all apps available in open way. I have some of them hidden with Yunohost SSO system. I do not host apps, that can be used anonymously, for example copy-paste tools or Nitter.
Not all routers provided by ISP support port forwarding. It can be locked for you. If you have normal IP address (even dynamic) you should be able to open this ports. My friend had to call his ISP and ask for opening the ports. Another way is to buy second router and use first router in bridge mode (which I do, because I started using OpenWrt).