I do both. Wireguard VPN for anything that's just me. Expose via nginx proxy for things that are shared with friends and family.