Use a reverse proxy in a DMZ. You can use something like Bunkerweb + Crowdsec to give you a WAF and dynamic IP blocklist in front of your web service.

Aren’t you able to see this in your Google account settings? I could have sworn I’ve seen a list of all the sites where I used “Sign in with Google”.

I’ve been running Home Assistant (HAOS) on Proxmox for years with no issues. It doesn’t need to be on bare metal. VMs work fine.