Immich: open ports vs CF tunel

Hi, I have a home server for Docker containers + an Asustor NAS mounted to it, where I keep all my large files. I need some advice on how to expose certain services to the internet.

I have my own domain, and my home connection is a symmetric 1 Gbps line with a static IP address.

Among the services I have on the server are, for example:

- Immich

- Jellyfin + the *arr stack (LAN only)

- AdGuard Home

- Linkwarden

- Planned: a small WordPress site

- Maybe something else in the future

I would like to have external access to Immich, and I'm wondering what would be better: opening ports 80/443 and using a reverse proxy (I use Caddy), or using a Cloudflare Tunnel.

WordPress will definitely be behind Cloudflare anyway, but in Immich's case, using a tunnel means the maximum upload size will be 100 MB.

Maybe that's not a problem, though? My main router is an Asus, and I have WireGuard set up on it, so connecting to my home network remotely is very easy. The only downside is that when I turn on this VPN on an Android phone, for example, it disables the VPN from the AdGuard app (which I use to block ads with cosmetic filters). Another thing is that I record videos relatively rarely, so uploading files larger than 100 MB is kind of an edge case. Besides, I'm usually at home, so what's the big deal if most of the syncing happens over the tunnel, and any larger files just get uploaded when I'm back home.

Meanwhile, when I experimented with opening ports 80 and 443, the Trend Micro software (on the Asus) almost immediately alerted me to automated attack attempts, e.g., on an Apache server. That's normal, but maybe it's better not to open anything after all? I really don't know, because another need might arise where CF will become a bottleneck (large files, or even AdGuard Home over DoT with ClientID verification).