Inspired by this comment to try to learn what I’m missing.
- Cloudflare proxy
 - Reverse Proxy
 - Fail2ban
 - Docker containers on their own networks
 
Another concern I have is does it need to be on a separate machine on a vlan from the rest of the network or is that too much?


TBF if you want, you can have a bastion server which is solely whitelisted by IP to stream your content from your local server. It’s obviously a pivot point for hackers, but it’s the level of effort that 99% of hackers would ignore unless they really wanted to target you. And if you’re that high value of a target, you probably shouldn’t be opening any ports on your network, which brings us back to your original solution.
I, too, don’t expose things to the public because I cannot afford the more safe/obfuscated solutions. But I do think there are reasonable measures that can be taken to expose your content to a wider audience if you wanted.