There's technically no distinction between a random url, and a random prime that is part of a keypair. There's a difference of "degree" of randomness, but not of approach.

In both cases you get owned if somebody guesses your random bytestring.

You're right, but I'm not really after "security". It's not like I'm hosting state secrets.

I may move to tailscale though, which would be the same thing without exposing anything publicly. Besides I already use tailscale for other things.

Don't worry, we hate you being that guy too ;)

Obscurity sometimes gets you enough, if only just cleaner log files. Something something threat model.