There's only three things that are acceptable when it comes exposing to public internet: a service load balancer, wireguard and ssh(well... for now). There is

There's only three things that are acceptable when it comes exposing to public internet: a service load balancer, wireguard and ssh(well... for now). There is also an exception with mtls authentication behind a load balancer where the load balancer tanks any kind of malicious / malformed traffic instead of compromising the backend service.