Proxy + Authelia on public IP vs Tailnet: What's your risk tolerance?

Are people out there running an authenticating reverse proxy like Authelia, Authentik, or Tinyauth on the public Internet? Ie: have your router send requests to your public home IP and trust the authenticator to then gateway access to your home services? How do you feel about the security of that? I run a bunch of services for myself on Proxmox: Immich, Linkding, Grafana, etc. Currently I have a mess of ad hoc access to them. Each service has its own authentication (usually username / password) and I access them via Tailscale. They only listen on my tailnet, no public Internet. I feel reasonably good in the security, it's just a mess. I'm trying something new. I set up a fancy Caddy + Authelia setup on a public IP address. It authenticates me and only then proxies my requests through to my services. Authelia also sets auth headers that the services trust. I don't have to log into Linkding itself anymore, it just trusts Authelia's authentication. It's a nice setup in theory. I now have a single *.example.com subdomain I can add new services to. No tailscale required. Authelia is nice, with solid 2FA and passkeys and good stuff. It scares the hell out of me. My services are now on the public Internet. I'm trusting Caddy + Authelia to be secure. Worse, I'm trusting my configuration of those services to be correct. And they're complicated, I only got it working with a lot of help from Claude. I think I understand it all and I think it's safe but I'm really not sure. And I don't know about maintaining it for 5+ years. As I write this I realize my real concern is the public Internet aspect of this. Maybe I should keep the fancy proxy setup to have a single point of entry but only run it on a tailnet address. What do people do for their homes?