People asked me what's the easiest way on how to run Alby Hub on a server but not publicly accessible.
imo an easy one is in the Alby Hub examples:
(e.g. https://github.com/getAlby/hub/blob/master/scripts/linux-x86_64/Caddyfile.example#L10-L15 )
just enable HTTP Auth on the webserver.
VPNs etc. are obviously great, too.

generally don't expose things publicly that don't need to be publicly accessible.