To reduce that, there are a few things you can do.

Option 1:

• Only open port 443 and run everything through a reverse proxy like traefik. You can open other ports ad you need them (game server for example)

• Run crowdsec to get rid of 95% of bad actors

• Whitelist IPs that you know traffic will be coming from and drop everything else

Option 2:

• wireguard VPN and just VPN into your home network to access your server

Option 3:

• Run tailscale

• run fail2ban

Absolutely a fair reason to be nervous. For this just follow the rules of minimum access. Only open the ports you need to open, and make sure they only point to the item you want to expose. That will take care of 99% of use cases. Most hacks you see happening right now with home labs are because someone did something pretty obvious - like exposing their router/firewall UI to the open internet (instead of it only being accessible to the local network), same with their data servers.

If you have a good network you can even restrict which IPs are allowed to connect through those ports, but remember if your mom’s IP changes or you’re sitting in a hotel then you’re essentially blocking yourself out (without a VPN or something).

Finally, and I would save this for a little later, you can move your Emby/external services to an alternate VLAN. VLANs are virtual-lans, they are a block of IPs that have firewall rules in between each of them. So you could do rules like “Internal clients can talk to Emby, but Emby cannot talk to Internal Clients”. This can be a daunting thing and will take a lot of trial and error, not to mention probably revamping your entire network - so I’d hold off for now.

I believe media hosting is only against their ToS if you try and use the proxy service. In the DNS page you would want to make sure the clouds are not orange. Fair warning though now your IP is exposed to the public.

Maybe. Personally it’s just another huge corpo that’s reading my traffic. There’s a dozen other middle men, but no doubt cloudflare wouldn’t hesitate to release all of my traffic at a moment’s notice.

Look into dynamic DNS. It’s for your exact case, when your up updates you need to update the DNS host with your new IP. Idk if Google domains does it, I use it with namecheap and then there’s an option in offense that will tell namecheap that my IP has changed.

This isn’t a “production” worthy option because there can be downtime when your Ip switches, but for us it’s perfect.