My router has a great wireguard integration, that makes it pretty easy to tunnel into my home network. I don’t open it to the outside in any other way. But yeah, it does require some maintenance and a backup strategy. I bought an unraid license back when the lifetime ones were still cheap, that makes it pretty easy to work on overall.

Have you thought about getting a homeserver? Immich is great service to selfhost for photos, paperless ngx is a very nice selfhosted document management system and there are several options for notes. If you use a VPN to connect you phone to your home network you don’t even have to expose any service to the general web.

Same boat for me, works great! I got the NFC Yubikeys which work fine with Android.