I just don't assign public Ip addresses to private VM.

Public (with different public ips) I have:

  * Mailcow
  * Postal
  * Code server (just a dev machine with public ip)
  * Wireguard
  * NginxProxyManager

Private (without public ip) I have:

  * PiHole
  * containers (where i run most of the staff)
  * Monitoring