Nothing you care about should have access to the open web. If your self-hosted services can be accessed by anyone with a web browser or curl, you're doing it wrong.