Just use subpath routing and fail2ban and Im very comfortable with exposing my home setup to the world.

The only thing served on / is a hello world nginx page. Everything else you need to know the randomly generated subpath route.