I'm considering running one "privately", but am worried about it being "discovered" and abused with unwanted traffic. And setting it behind a VPN seems like a hassle.
The official instructions use nginx as a reverse proxy. If you don't want to set up something like Wireguard, you can use HTTP basic authentication[0] to make it inaccessible/invisible without a username/password. (You definitely want to also set up certbot[1] for SSL if you go this route.)
[0]: https://docs.nginx.com/nginx/admin-guide/security-controls/c...
Also comes in handy when traveling, for services like Netflix that geoblock you based on your IP address.