I don't trust them either, so the only way I am OK running anything self-hosted is behind private VPN. Wireguard is great for this since it is a silent protocol

I don't trust them either, so the only way I am OK running anything self-hosted is behind private VPN. Wireguard is great for this since it is a silent protocol and no mass scanning of internet will reveal it is running there. It can be found out only by snooping on data traffic but even then it has good security. On top of that I also use https for internal-only services. Another great option is Cloudlare with it's "cloudflared" tool. Combine that with OIDC+forwardauth and I would be OK exposing some not so critical systems to the internet.