You are self hosting probably open source stuff you found on GitHub. It’s probably not commercial but community based. I support opensource but they don’t have as much resources to make sure the services are fully secure. That’s one thing.
The second thing is you like tinkering but you probably haven’t researched anything about cybersecurity, it’s a full time job.
The only sliver of hope you have when opening a service online is to hide your ip and setup some access rules. You chose to not even do that.
If you hook up cloudflare tunnels, you’ll quickly notice how many bots check your ip/domain, all the freaking time.
I use their WAF rules extensively to limit access to my server to a few IPs for my family and friends.
I’d rather get an N100 minipc in this case. Similar performance but able to do media transcode a lot better