I have my services proxied through nginx and behind cloudflares free tier. That way I don’t have to worry about my IP getting exposed and opening myself up to DDOS/DOS attacks, which is a genuine threat if you do things that piss people off (I’m an admin on a popular minecraft server).

You could put the pi on its own subnet. That way if it’s hacked, the rest of the network is protected. Just make sure your router admin interface doesn’t answer on that subnet.

If you port forward to your Pi, only your Pi will be exposed. But, if your Pi gets pwned, it can in turn attack anything next to it. Safest is to isolate the Pi on it’s own subnet or a DMZ if your router has the functionality.

Of note, many home ISPs block standard server ports like 80 and 443. You might need to use non standard ports like 8080 and 8443

The port forward only forwards to a single device so you aren’t exposing your PC (directly anyway). Sounds like you have the pi good and secured but if you wanted to add another layer you could segment it out into a DMZ or its own VLAN. That way if something did happen with it an attacker couldn’t move laterally inside your network.

Realistically though you’re in good shape.

I would suggest signing up for a free Cloudflare account and setting up any DNS for your Pi through there, using the Cache feature.

Once that is done, setup an automated script that will pull down Cloudflare IPs into a file (you can use a cronjob to run this daily):

#!/bin/bash

set -e

cf_ips() {
  echo "# https://www.cloudflare.com/ips"

  for type in v4 v6; do
    echo "# IP$type"
    curl -sL "https://www.cloudflare.com/ips-$type/" | sed "s|^|allow |g" | sed "s|\$|;|g"
    echo
  done

  echo "# Generated at $(LC_ALL=C date)"
}

cf_ips > allow-cloudflare.conf
(cf_ips && echo "deny all; # deny all remaining ips") > allow-cloudflare-only.conf

Then in your web server config to only accept connections from Cloudflare IPs:

server {
	listen 80 default_server;
	listen [::]:80 default_server;
	server_name example.com;
        root /var/www/html;

	include /etc/nginx/allow-cloudflare-only.conf;
}

I prefer this method over UFW/iptables block as it allows you to control the IP block per web config, so if needed, you can make exceptions by not adding the include /etc/nginx/allow-cloudflare-only.conf; into that specific site’s conf file.

No