You are ignoring people who have walked this path and are giving you the advice right now.

Public file hosting is not where you start.

Pro-Tip: You can reverse proxy any service on your network but if the IP of your reverse proxy does not match the IP of your A record, aka your server is behind a VPN, the public will not be able to access your server.

Http/s is neat that way, if the IP’s don’t match then it’s technically considered an insecure or misconfigured setup but it works great to prevent unauthorized access to one’s server.

I must agree with other users here, hosting a public file hosting server is a bad idea, at the bare minimum Authentik or Keycloak should be in front of it but I digress, catbox.moe already endures this pain for us.

Not sure what reverse proxy you’re using but alternatively Traefik’s middleware IPAllowList works great for blacklisting all IP’s and only whitelisting the known few.

you start with authenticated things, like forgejo and such, and always double check that anonymous visitors don’t see any data.

but generally it’s also not wise to just expose most services to the internet. jellyfin for example had lots of leaks because lots of API functionality was accessible without authentication. I don’t know if it’s been fully fixed.
expose a wireguard, it is safe, it is security software, and access everything else through it. you can keep using your domain for internal services.

with copyparty there’s an added risk. if police finds you hosted child porn, they won’t care if it wasn’t you who uploaded it. someone reports it to them, they steal all your computers, worst case you can even end up in jail.

I don’t mean to add to the discourse here or to keep giving you hypotheticals but, while learning to self host is fun and cool, you really do not want this thing on public Internet. Even if you can delete files to prevent uncouth things, what if someone uploads something while you’re asleep, or away from your computer? Do you have others monitoring the instance to take down CSAM or other illegal material? What if someone uploads malware and it executes on your machine? If you must leave it exposed, you should allow only family and friends to access via a strongly passworded account(I think that is configurable with copy party).

If you really want to expose services, try a media server like Plex or Jellyfin. You don’t want strangers to upload things to your machines.

I really don’t know why someone is that stupid… People explain why he/she should take it offline, for obvious reasons… and he/she still think it’s a good idea and continue. Some people have to learn it the hard way…

There’s no way you’re actually this dumb. Come on. Quit trolling.