I use cloudflare tunnels. No need to do anything to my router. I have 1 open publicly accessible port (80) exposed to the internet via Docker container. In order to reach that port, you have to traverse the tunnel with TLS and my home IP is never exposed and always updated except to Cloudflare. Literally one command and few configs to set up on Cloudflare to proxy traffic to my localhost and various subdomains.

You can have application level security enabled on Cloudflare's side for administrative interfaces, like portainer. That adds another level of security and there are a multitude of ways to verify (Email, token, one time pin, etc.). Super, super easy to set up.

I am a dolt when it comes to networking and don't trust myself to make the correct configurations. I no longer pay for a VPS for my simple blog. I don't want to spend my time becoming an expert Sys Admin/Network Admin... so I chose to go with a tunnel.