Shortcut: use Tailscale to create your own private network and avoid hosting on the big, bad Internet. Otherwise, you really have to be careful on how you protect your services.
Minor downside (or upside) is that you'll have to install the Tailscale app on each device you want to make part of the network.
This made hosting at home a lot easier for me.
Update:
Ah! I misread the post. Tailscale doesn't make sense for this use case. My bad! đ
I already selfhost lots of stuff for family and friends using reverse proxy+https a public domain(s) and a VPS tunneled back (wireguard) home since I am behind CGNAT. And authelia on top of it all.
My setup should be safe enough also for a Lemmy instance.
If you haven't seen it, headscale is an open source controller for tailscale clients. Assuming your allergies are related to using their public offering.