Not GP but may be helpful to someone: I wouldn't expose any home-net service to the internet except Wireguard VPN. It listens on connection-less UDP and only responds to clients with recognized auth key. On the router you just forward UDP port to machine with WG. There are clients for Windows, Mac, smartphones.