You put layers Like an onion

So you put cloudflare or tailscale or netbird or whatever infront of your thing. So you need at least two zero days for different products to be immediately fucked

Don't expose your stuff publicly and it's pretty much a non-issue. There's no reason your private git server needs to be accessible from the web. If you need to access it when you're away from home, you can just connect back to your network with a VPN or SSH tunnel and then access your services like normal.

I used to self host externally but keeping up with all the security just became exhausting after awhile. I pulled it all back behind a VPN, been so much nicer after. my containers still patch nightly, which up until now hasn't been an issue. Then i patch and reboot the actual servers quarterly. not so bad. So i would suggest if you are self hosting to not expose to the internet at all.