Doesn’t matter who makes the software, as long as it’s open sourced and audited.

Just because you can doesn’t mean anyone does. I’ve never seen an ISP hand out “private” IPv6 addresses. Ever.

If you’re doing NAT on IPv6, you’re doing it wrong and stupid. Plain and simple.

Network Prefix Translation isn’t the same thing. That’s used for things like MultiWAN so that your IPv6 subnet from another WAN during a failover event can still communicate by chopping off the first half and replacing the subnet with the one from the secondary WAN. It is not NAT like in IPv4 and doesn’t have all of the pitfalls and gotchas. You still have direct communications without the need for things like port forwarding or 1:1 NAT translations.

I’m a Network Engineer of over a decade and a half. I live and breath this shit. Lol.

CGNAT only applies to IPv4. You cannot NAT IPv6 effectively. It’s not designed to be NATed. While there IS provisions for private IPv6 addressing, nobody actually does it because it’s pointless.

It’s why IPv6 is important, but many didn’t listen.

Yes, but OP mentioned nothing about Cloudflare.

Sweet. Both OPNSense and pfSense firewalls have the ability to tie into MaxMind’s GeoIP service. Not sure what your perimeter device is, but it’s pretty easy on those. And free.

Best solution is a VPN to your home network.

However, if you want to host it publicly, at least restrict access to it via GeoIP. For example, if you live in Europe and only need access from there, only allow the areas in Europe you travel to and block everything else. This will greatly reduce your attack surface.

Also, make sure everything is patched. Always. And implement something like fail2ban to deny repeated failed logins, along with a reverse proxy.