calibre safe setup

seems like opening up a port to calibre is a horrible idea - even with a username/password and a letsencrypt certificate. Anyone have a calibre server type of setup that works well? I started getting into Calibre-server, and lazylibrarian-calibre but it seems that I'm spiraling down a blackhole of configuration paths and docker paths. How about making the DB available, and connecting a regular Calibre desktop client to a remote database? I haven't tried that option yet. T

Here's my setup: LL to download books and books are left in an import folder for Calibre to import and LL shares the Calibre library RDP-Calibre imports the books and I use to tidy-up metadata etc calibre-web is a very nice front-end to download and browse books and allows multiple users to track their reading progress e.g. I've created accounts for my kids, family and friends. calibre-web is accessible via the web via LE, so no need to open a port. Very easy one-time s