On the vpn/proxy idk, I think the bots would pass through it.

There are some nginx blocklists like the ultimate bad bot blocker, I could share my Cloudflare rules if you want it, as these are rules, it can be abstracted to anywhere.

I run my instance using cloudflare tunnels, directly from my thinkpad (over wifi), these tunnels are helpful because you don’t need to open ports, etc, also, there are other tunneling options, like hosting a server on a VPS that tunnels to your own selfhosted server, as there are some alternatives to cloudflare in that aspect.

Idk, might be an option.