Other than "don't do it", what's crucial when exposing unRAID to the Internet?

Yes, I know that exposing unRAID to the internet is not recommended, but if the necessity arises, what factors in what order need to be considered when doing so?

I'm starting to study the threads about setting up unRAID with a reverse proxy, letsencrypt, etc., but wanna do the most critical things first to lock down the system as best as is possible with ports 80 and 443 exposed.