I recently set up Nginx on a DO droplet as a reverse proxy to my home server over Wireguard. It's not $0 but it doesn't directly expose my home IP. And I have an authoritative resolver on the LAN so local clients go directly to the private address.
I've been thinking about this kind of setup for my and my family's data, at least.