I own a few domain names, so I would use that. Since it's DHCP for my WAN, I might go with a dynamic DNS but use a redirect from my domain name to it (CNAME entry, if you're familiar with DNS).

But ZT is superior to wire guard (and most other VPN systems) in that it does automatic NAT traversal. So if I use ZT, I don't need to worry about port forwards. ZT does everything for me (NAT "hole punching" and handles all aspects of the VPN connection).

With CloudFlare, I can use one of my domain names, pointed at their service and essentially it acts as a combination of reverse proxy and VPN to the system....

I'm mostly concerned about any exploits related to the web service built into Casa OS, that someone could spoof a request that breaks security, so I'm hesitant to just expose it to the internet like that. VPN would be better but requires a lot more set up on the family computers, phones and such.

There's also the option of Nabu Casa, the home assistant cloud subscription, which would help home assistant financially (which is a good thing), and get me the functionality I'm looking for, but I'm not keen on yet-another-subscription-service coming out of my account every month. I've been trying to cut back on those things. I already don't pay for Netflix, Disney+, etc. I don't really want to add to that list that I'm trying to get to zero.

Too many options. Ugh.