If you are hosting other things with it, then a reverse proxy like Caddy or Traefik + crowdsec is pretty much as good as you are going to get and you can add region blocking on your router (if that feature is available) or if you use cloudflare as a proxy.
If you want to go really crazy, you can put authelia/Authentik in front of it, depending on what else you host.