If it’s only you (or your household) that is accessing the services then something like hosting a tailscale VPN is a relatively user friendly and safe way to set-up remote access.

If not, then you’d probably want to either use the aforementioned Cloudflare tunnels, or set up a reverse proxy container (nginx proxy manager is quite nice for this as it also handles certs and stuff for you). Then port forward ports 80 and 443 to the server (or container if you give it a separate IP). This can be done in your router.

In terms of domain set-up. I’ve always found subdomains (homeassistant.domain.com) to be way less of a hassle compared to directories (domain.com/homeassistant) since the latter may need additional config on the application end.

Get a cheap domain at like Cloudflare and use CNAME records that point domain.com and *.domain.com to your dyndns host. Iirc there’s also some routers/containers that can do ddns with Cloudflare directly, so that might be worth a quick check too.

Talking about Lan uplinks, in the early 2010’s I had the joy of working with a 20gb uplink at a small university LAN (the sysadmin got a good amount of free pizza and beers for that one). I spent a large amount of my savings on a 10gb NIC only to find out my hard drive couldn’t keep up lol.

There’s a couple SD-WAN solutions out there that you can do this with. Essentially route all your traffic through one or more VPSes while still keeping things like port forwards and STUN working properly.

I’ve had to use it to enable proper video feeds to and from people that had Spectrum as their ISP.

For some reason every registrars dns panel has its own weird restrictions, bugs and interface quirks. Pointing the nameservers to Cloudflare at least makes for a consistent experience.