I built something similar for my girlfriend's birthday a few months ago. A buzzer and a lightbulb connected through a relay to an RPi, which hosts a basic HTTP server. The server is exposed to the Internet through a reverse ssh tunnel to a VPS in the cloud.

What has taken me aback is how it regularly receives malicious traffic that I suspect is from bots scanning for vulnerable servers. The hostname is not shared anywhere public. The client app that knows the URL has only been shared to her as an APK. Made me realize there's no such thing as security through obscurity.