A few tips off the top of my head, in no particular order:

• do not allow public access to any of this. It’s not trivial to set up a wireguard tunnel so that you can reach your home network from e.g. your phone or laptop when you’re away, but it’s also not highly complicated. Usually your home Internet router can already get you half way there.

• if you must have some service available from the public net, it’s better to e.g. host it on a cheap VPS. That way if your things get hacked again (via no fault of your own), your home network is safe.

• set up automatics updates, at least for minor updates. If you’re fine with waiting for a few days in case an update crashes one of your services, it’s a good idea to just make it all auto update. Crash recovery from a backup is a simpler problem then setting up from scratch because your outdated service got hacked and now attackers own your home server, home router, TV, fridge, LEDs and whatever else is Internet capable at your home.

• use 2fa for any service you expose to public internet. Minor inconvenience, mitigates or avoids a whole series of errors.

• document what you’re doing in a simple doc. Can be a simple doc on your next cloud instance, just at a little note/log entry every time you do something. “added robo vacuum cleaner integration to my home assistant. Had to use version 1.2.3 because my robot is an older gen. Password’s on my phone.” helps a lot when something goes wrong later and you forgot what you did.

• test backup recovery. Just delete everything and see if and how you can get it back. If you’re afraid to do that, you don’t have a backup.

• simple monitori