Port Forwarding

Hello all! I've been selfhosting for roughly a year now. I've been using tailscale to access my stuff outside my home network, but I'd like to start port forwarding, as that would make it a lot easier for things such as portable rokus and such for my family. What do I need to know/do before I port forward, security-wise? I don't have many apps currently (airsonic advanced, jellyfin, and immich), although that might grow in the future. Any tips or tricks would be greatly appreciated!