Ok, this should be pretty easy then. Just set up an instance in a cloud service provider (Oracle has lots of free stuff for this) and set up wireguard. Establish a VPN connection to your cloud server and port forward from there.
If you do know how to protect that open port then this should be pretty straightforward.
I use portainer, and when I deploy an image, I write a short bash script for it.
This lets me easily do updates. I have a script for each image I run, it’s less than a dozen. They’re all from public repositories.