Safest move would be to not actually expose your server from your public IP, but instead tunnel traffic from your home server through a cheap, public-facing VPS

Safest move would be to not actually expose your server from your public IP, but instead tunnel traffic from your home server through a cheap, public-facing VPS instance acting as a gateway host. To fully automate, you can use a premade tool like autossh, or just replicate it using standard ssh with keepalive option + a custom sysd unit file.