If you are self hosting it, at least put a reverse proxy of it infront to control what is actually accessible. You can easily slap a traefik infront and get LE certs automatically, then terminate TLS at that level.