Currently I expose port 22 for SSH, 443 for Nginx and a couple extra for Syncthing (to mirror my media files between a Hetzner Storage Box and my NAS at home).
There's a specific setup I tried to build once but didn't manage:

• Expose only Wireguard port from my VPS
• make it so that when (and only when) a device is connected to the VPS via Wireguard, then mydomain.xyz will target the VPS' IP (and therefore hit my Nginx proxy which redirects to my various services at myservices.mydomain.xyz.

I tried by having a Adguard Home running on that same VPS, and setting its IP as the DNS in the wg0.conf that goes on the client device but it didn't work.

Ease of use. Manually setting up bridges for every messaging conversation you’re in is a pain.