> I'd rather expose a Wireguard port and control my keys than introduce a third party like Tailscale.

This is what I do. You can do Tailscale like access using things like Pangolin[0].

You can also use a bastion host, or block all ports and set up Tor or i2p, and then anyone that even wants to talk to your server will need to know cryptographic keys to route traffic to it at all, on top of your SSH/WG/etc keys.

> I am not sure why people are so afraid of exposing ports. I have dozens of ports open on my server including SMTP, IMAP(S), HTTP(S), various game servers and don't see a problem with that.

This is what I don't do. Anything that needs real internet access like mail, raw web access, etc gets its own VPS where an attack will stay isolated, which is important as more self-hosted services are implemented using things like React and Next[1].

[0] https://github.com/fosrl/pangolin

[1] https://news.ycombinator.com/item?id=46136026