None of my services are available outside my house without first logging into the fortigate SSL VPN. That is the only open port I have.

The SSL VPN uses a loopback interface so only IPs from the US can access it, and I have strong auto block enabled and I add IPs of systems that try brute forcing into the box so they get blocked

I did forget to mention that I use cloud flair already for the exact reason you mentioned so my home IP is not used.

I also have a domain name with valid wildcard certificate. The domain is used to access the SSL VPN and I also then use the cert within my entire homelab so I have everything encrypted

I was not a fan of PF sense, the fortigate has more security features that I wanted