Use a reverse proxy in a DMZ. You can use something like Bunkerweb + Crowdsec to give you a WAF and dynamic IP blocklist in front of your web service.

Ah the ole “Streisand effect”.

I’ve been running Home Assistant (HAOS) on Proxmox for years with no issues. It doesn’t need to be on bare metal. VMs work fine.

I’m using Mullvad at the moment as well and looking to change for the same reason. I’ve been looking at switching to AirVPN once all my credit runs out on Mullvad. They have a similar model to Mullvad, but they allow port forwarding.