If the OP has it only reachable via a VPN, that might be good enough, it’s not directly exposed. But otherwise yes.

Another, more important problem with publicly available home server: they lost their data when their setup was maintained by a professional hoster. According to the OPs words, they themselves “know just enough to be dangerous”.

Exposing any of this to the public internet wouldn’t be a good idea however you put it.