Mine is open to the internet, via a nginx reverse proxy. I made it ban people who try to brute-force my password. It's been fine like that for years now:
http:
trusted_proxies:
- w.x.y.z
use_x_forwarded_for: true
ip_ban_enabled: true
login_attempts_threshold: 10