This comes into the design and requirements for your services.
If they need to be public ally available to more than just you, you’ll want a reverse proxy and appropriate firewall rules. You’ll also need to make sure things stay updated and security hardening is done on the servers and the proxy.
If you just need yourself to access things and they don’t need full access from public internet, you want a VPN. Tailscale is pretty easy. Wireguard is a bit of work to set up, but can make for a good always on VPN for your devices to connect back into your home network to access what you want.
There are certain things like SSH that you really don’t want publically accessible over the internet. Even with fail2ban and all the security hardening, it’s just a headache and pointless traffic you’ll deal with as people try to get in anyway.