A viable concern if you wanted to put it public-facing. If you only care about syncing when you’re home, though, you should be able to host it perfectly fine just not giving any pathways in from the outside world.

If you wanted to use the Android application, you would have to learn about TLS certificates anyway, because it doesn’t work without HTTPS.