Mine is on the internet behind nginx. I block connections not originating in countries that are reasonable for my family. I don’t like geoip blocking but it straight up eliminated almost all the IDS alerts. I needed to migrate to DNS based validation for certbot.
If I or my family leave the geo region, I’m “away” anyways until I return to the area and my device gets a new IP. Or I can allow the country temporarily.
With the price of oil and therefore plane tickets what it is, I won’t be leaving my geo region.