I thought about something like that as well, but never tried it out (yet). Do you use WireGuard tunnels for that? Or something else?
Ideally I’d not expose most of the services to the public internet at all, since only me and some relatives need access to most of them. I have briefly looked into Tailscale or similar services for that, but again, haven’t tried that out yet, as that would (presumably) require changing quite a few things on both the server(s) and all of the clients…
After all, I’m just cosplaying as a sysadmin for the most part, so what do I know ;)