>and just deal with the fact it's not externally available

Perhaps wireguard(or tailscale just for this bit). Not saying you have to, having local only as default is perfectly good and safer maybe!