

I recommend it every time this question pops up and I’m surprised more people aren’t privy to it:
Rent a VPS as your public gateway. Connect the VPS to your server with a simple wireguard tunnel.
The only thing on the VPS should be a reverse proxy with SSL/TLS pass through.
Send the traffic at the VPS reverse proxy to a reverse proxy on the main server. Configure this proxy to use letsencrypt certs.
The benefit and importance of the SSL pass through reverse proxy, is that it allows all data in transit to remain encrypted until it reaches your physical server. Traditionally, most would suggest the one and only reverse proxy exist on the VPS but all traffic would then be decrypted on the VPS. This could obviously compromise your traffic if the VPS provider snoops or your VPS is compromised.
Cloudflare tunnels decrypt on their hardware as well, which is why I always recommend avoiding their services.
Yes, it will count towards your bandwidth.
I typically don’t get anywhere close to this though.
The few times I did were due to initiating large backups between devices, upwards of 2TB. But I’ve since moved my backup system to a mesh network and haven’t hit bandwidth overages since.