You could put your services behind a reverse proxy such as Traefik with forward-auth and expose it to port 443 (HTTPS) on your router, or (that's what I do and am happy with) use the cloudflared [1] demon to connect your services to Cloudflare where they can be protected behind Cloudflare Access using an SSO provider such as Okta (or Github or Google) for authentication. This method does not require you to expose any ports on your router and can all be done on the free/dev tiers of Cloudflare and Okta.
How do I do all this while exposing it to the internet? I want to host stuff for my friends and family without putting them on a VPN to my house.