Good advice, this is what I do. I expose a few services on HTTPS, behind a reverse proxy. Everything else is WireGuard.