VPN is the way to go. Could use this opportunity to upgrade your router. I bought a box from protectli and run OPNsense on it. There’s good documentation on how to set up a wireguard vpn, and the community is vibrant.

Its also nice because there’s lots of options so its a nice thing to grow and learn with.

Getting an obscure domain name doesn’t matter as attackers go straight to the IP address. If you have a certificate on your secret domain name, they have your domain the moment they hit port 443.

Don’t use “security through obscurity”; instead just secure your services or host a VPN.

This is my policy: For publicly accessible services like a website, I use a cloudflare tunnel. For restricted access to just a few users, I use a cloudflare tunnel and a cloudflare application to manage access authentication. For my exclusive restricted access to the infrastructure, I used tailscale.

ZeroTeir (or a VPN) - if all you want is to access those services from outside your network

IMO - the only reason to put something “on the internet” is so that the entire “internet” can access it

Try using Tailscale. It’s easy to use & free for personal use. It will only allow devices with Tailscale installed to view your self-hosted services. They have clients for mobile devices, PC’s, Mac’s and even Apple TV etc. Their technology is based on Wireguard so it’s very fast and secure.

https://tailscale.com/

6 to 9 digit .xyz domains are only around $1 a year, every year. That’s what I did and definitely recommend it. You can read more here.

If you go with a cert try to get a star cert that way you make it a little bit harder for hackers to find your subdomains.

Seriously as everyone suggests: use tailscale or another VPN. Tailscale is incredbly easy to setup.

VPN would be the quick and dirty

If it’s just select items, an service like azure app proxy maybe

Use cloudflared and Cloudflare Zero Trust / Access. You tunnel your services to Cloudflare, who then secures them behind a 2FA wall. No traffic ever goes to anyone aside from you.

Isn’t this what VPNs were invented for?

Free domains such as .tk or .cf are scanned by various bots as soon as they are created. I remember when I created a domain and forwarded it to my server. The spam and attacks that subsequently hit my server were very high. Significantly higher than with a domain that I paid for.

I therefore strongly recommend staying away from these free domains.

Good luck with your project :)

this is what i did. a 10 CHAR domain of only numbers with .win

I use WireGuard for most stuff. My Nextcloud instance is open though because I lien to upload photos I take pretty quickly to keep a backup

Warning: tk domains registrar has 0 GDPR.

Might be irrelevant now, but I didn’t managed to delete my data once I wanted out