

Back in the days we’d get free hosting and slap phpBB on it. Run for kids by kids, no pesky adult rules!
Those were the days. No credit cards needed, no nothing, just free 50MB of Apache/MySQL/PHP4 hosting with no strings attached.
If the fediverse was a thing I’d probably have had my own instance starting age 14-15ish.
Is it directly exposed over the Internet? If you only port forward the VPN on your router, I wouldn’t worry about it unless you’re worried about someone else already on your LAN.
And even then, it’s really more like an extra layer of security against accidentally running something exposed publicly that you didn’t intend to, or maybe you want some services to only be accessible via a particular private interface. You don’t need a firewall if you have nothing to filter in the first place.
A machine without a firewall that doesn’t have any open port behave practically the same from a security standpoint: nothing’s gonna happen. The only difference is the port showing as closed vs filtered in nmap, and the server refusing to send any response not even a rejection, but that’s it.