I actually haven't opened it up, directly that is. It's a bit complicated.
A few years ago, I put a copy of NGINX for Windows on my weather PC. I configured it to serve up subdomains of my Bismarckweather.net. For each subdomain, I created a CNAME entry on GoDaddy pointing to my NOIP DNS name. So if my home IP changes, NOIP DNS record changes, and my subdomain name stays pointing to my home PC.
One of the features of NGINX is that you can setup a reverse proxy. NGINX calls it "proxypass". So as traffic comes in to say my test.bismarckweather.net DNS name, it relays the traffic to my Synology web server. So my weather station copy of HTTPS is acting as a proxy to protect my site from direct hacking.
So I have broadcast.bismarckweather.net, test.bismarckweather.net, and a few others. All with their own pointers to either folders, or to devices internal to my network. So test.bismarckweather.net traffic comes into my weather PC NGIX, then is passed onto the Synology. So the Synology serves up the webpages through my weather PC. But if the weather PC is down, so is my test site. Not that is super likely.
Along with that, I use a program called Certify the web. That gets me my Let's Encrypt certificates. I have one for *.bismarckweather.net. That allows me to put he certs on my GoDaddy site and my NGINX at home. So SSL for everything in one cert. Including my Plex server and NAS internally.
It was a lot of work to figure it all out. But externally, I only have port 443 open in my firewall. And "most" of my subdomains have a redirect to my main site if someone tries to access it. So it stays mostly secured.
