It's as safe as you make it. Read up and use configurations documented for "production environments" and you have to monitor things yourself. Try to avoid exposing anything to the internet that you don't have to and use a secure VPN if you can. That limits the exposed attack surface quite a bit.

Otherwise, use things like crowdsec and/or fail2ban along with ensuring your firewalls are configured to drop all ports not needed. A reverse proxy like Traefik or Caddy in front of all of your web services along with valid TLS/SSL certificates from Let's Encrypt can help to only need port 443 open most of the time. Crowdsec or fail2ban can then be integrated into the reverse proxy as well to simplify things. It can be difficult to set up the first service, but then things start to fall into place over time.

Also, be sure to document everything you do, so that you can reproduce it if you need to recover from a disaster as well as to make setting up new services easier.