@Rin3d CGNAT is only an issue for ipv4, if you're able to use ipv6 that should work around the issue with that

threat protection is all about what you want to do and what you care about. A static site? Not much to protect there except perhaps the content from AI scrapers, for which i'd use https://anubis.techaro.lol/

If its some service for myself, i'd just lock it down with a decent password. If its for public use and non-static, thats where things get more difficult.

As for networking stack: it takes a bit of time to learn, but its actually not that incredibly complex i feel. The most difficult part is likely to not get bogged down in concepts and solutions meant for larger scales. All you really need is a registrar for a domain and to know that a DNS record is just "if someone asks for X, they can find it at Y", if tou want a domain, and what a port is and how you can open (port-forward) one in your router. Not something you get done in half an hour, but also not something that should take days of research.

I'm not saying its easy, or simple. I'm saying its comparable to many many topics/hobbies/jobs: theres some stuff you gotta learn and a lot of stuff you don't need, and the difficulty lies not in the content but in distinguishing useless from useful information. And targeted (to selfhosting) resources will generally leave out or label the topics you might not need.

dunno if that helps, maybe i'm underestimating the amount of knowledge required because this is partially my job