I have an oracle free tier vps that I run reverse proxy on and have certs for subdomains for a domain I got on cloudflare. Cloudflare dns points to the vps, apache server proxy on port 80/443. On the vps I also have tailscale and another tailscale on a server at home advertising routes.
So I have music.mydomain for subsonic and plex.mydomain and files.mydomain for nextcloud, etc.
Its normal https web traffic so weird ports dont need to be accessed or remembered.