What I do is this - and some may frown upon it because well…Cloudflare! But I use Cloudflare’s tunnels to access my remote instances for my password manager, Home Assistant and a SSH shell. All of which are behind passwords and 2FA. I then have only one port open on my router, that’s for my wireguard instance. I access it using my ddns and can be on my home network from anywhere.
I’d move away from the tunnels and push everything through WG, but my family is not as savvy as I am and don’t always activate the tunnel when away from home. I am putting a plan for that this weekend though. :)