You could use a Cloudflare tunnel if you really wanted to avoid opening ports, but basically as long as you only open the right ports for what you want to host and have a good firewall (I use OPNSense) you're fine