Mini PC is great for private/tailscale use. If you have a mini PC or rpi open to the public internet, you need to worry about the "vulnpocalypse" pwning your whole LAN and every machine on it.

Yep, I have a decently powerful home server that's always on, but still run a cheap VPS for directly public services like my sites. I don't think it's particularly likely that the home server would get hacked if updates were to br kept up with, but why risk it for that little money?

I use Cloudflare tunnels for anything I want to expose to the internet, that gives me enough peace of mind, though I understand a VPS would be the least-risk and highest-uptime option, my risk profile and uptime requirements don't make it necessary.

Cloudflare tunnels work pretty well for this, tho. That with vlan or diff lan and it’s mostly fine.