Instead of opening ports on your firewall, you could introduce a mesh. I'm using nebula by slack, rest is 90's style with apache /nginx, lego for le dns-challen

Instead of opening ports on your firewall, you could introduce a mesh. I'm using nebula by slack, rest is 90's style with apache /nginx, lego for le dns-challenged certs, and the nebula lighthouse as a proxy. Works fine, is secure and does not bind 443 on your router to.a specific pi.