Nothing to protect if you don’t expose it.

Plain and simple - Wireguard.

All services run as separate services user in rootless podman containers.

Only one nginx exposed to the open internet acting as reverse proxy to stuff where Wireguard requirement would be too inconvenient to be useful (shared calendar).

Not sure my Raspberry is powerful enough to handle docker or if there are suitable images for arm. Otherwise sure that would be even simpler.

I use Radicale for a self hosted shared calendar and todo lists and notes with my wife.

Radicale on raspberry pi Android apps: Davx5 Jtx board Fossify calendar