+1 for cloudflare. But I don’t use their tunnel products, I just expose my ports to only their known IPs. With cloudflare you have a nice “free” waf in front with tls that points to a secure(nginx proxy) or unsecured docker container. Audiobookshelf is a great example. Is best to use their dns product too, for easy management of your public facing sites.

+1 on this. Though i picked up 2 u7’s. VLAN support, easy to maintain and lets face it, superior function from most retail APs. If you’re a power user, this is the way.