Personally I proxy everything through cloudflare tunnels using a wildcard cert, and have Authelia in front of everything. No open ports.

Haven’t had bot problems since swapping to this setup.