I've had to find a solution similar to what you are looking for. My need was due to being double NAT'ed where I had no control over the internet facing router/NAT.

Personally, my solution was to use Oracle Clouds free tier service to host and NGINX reverse proxy as Oracle also offers free static IPs to there compute instances. From there I used Tailscale to join the instance to a Proxmox container running Docker on my server running services I wanted exposed to the internet (Emby, and a few 'Arrr apps). I've found it to be remarkably stable (much more than I expected).

An alternative method is to use Cloudflare tunnels, which are very easy to get setup. It in essence is the same principle as above but using Cloudflare's 'reverse proxy as a service' type product. I was not able to use this for my needs as Cloudflare do not allow media streaming.

If you do choose the first option, I would recommend isolating the server running the exposed services to its own network that cannot touch your day-to-day network. I also recommend configuring ACLs in Tailscale to restrict traffic to specific ports from specific hosts to minimise any risk of having exposed services. Oh, and automatic updates to the OS and services is ideal.

I saw you are using basic HTTP auth, whilst it is secure enough it does have some issues with making connections more difficult, particularly if you are using any of your services API's (it is also not the best user experience IMO). I would recommend setting up oAuth/SSO if yunohost supports it.

Lastly, as other users have said, even if you don't use either suggestion, put a reverse proxy on it. NGINX Proxy Manager is a nice friendly solution with a web GUI if you are not too familiar with proxy configs

It's best practise to use a reverse proxy like nginx ... for authentication

What kind of authentication are you using for nginx? Just basic http authentication with a .htpasswd file?

That's what I'm using right now, but I've found that not all services play nice with it.

I've hidden everything behind Wireguard.
externally my server doesn't even have open ports. everyone who uses my services gets a Wireguard key.

don't know how many people you wanna service or if it's just you - then Wireguard could be a viable solution

If you are cool with using Cloudflare, you can use Argo Tunnel to expose HTTP(S) services to the internet with DDOS protection and all of Cloudflares features.

They've made it free some time ago, you just need a pc/server in your network running the cloudflare agent software.

https://www.cloudflare.com/products/tunnel/

You have several options these days:

1. Use cloudflare in DNS proxy mode and run a dynamic DNS updater so cloudflare always point to your correct IP address. By using cloudflare DNS in proxy mode, your real IP address will be hidden because all traffics will be routed via cloudflare servers first. The disadvantage is it only works for http/https service. If you need to route other service/port (e.g. ssh) you'll need to use cloudflare tunnel

2. Rent a small vps and use it as a bastion server. Add your home server and the vps server into tailscale or zerotier network, and then configure it to route traffics to your home server. I personally use this method because it gives me full control and flexibility over using cloudflare, but it does harder to setup.

Google cloudflared tunnels, zeroteir and tailscale. They all solve this exact problem, I've been using cloudflared tunnels to host without exposing my ip for while now, it's relatively easy for https services.

Edit: also just because services require login, doesn't necessarily make them secure if their implementation is terrible. It's best practise to use a reverse proxy like nginx which specialises in having not shit security for authentication, and proxy your services behind it.