You can use CF Tunnel so you don't need to expose any ports from your router. They'll also do SSL termination for you as well. You can use their free plan for this AFAIK. You can also run your own SSL proxy as well with HAProxy or Nginx. I'd just use CF, it's easier TBH.