Crowdsec is excellent. Also add per country block for inbound connections. If you expose the services to a few friends and family members limit inbound access to their country. Just remember to change the list when travelling abroad and coming back.

You should also use a default self-signed cert for something generic like “localhost” on your reverse proxy so random IP scan don’t see any domain when they hit your IP, but legitimate queries coming through the domain name still see the right cert.

I had a hard time too when I first tried to get netbird going but reading the https://docs.netbird.io/manage/access-control section of the docs cleared things up, especially the part about not putting all your devices in the same group.