I would highly suggest using a separate VLAN at the minimum directly off your firewall, and at the ingress of your firewall put rules in blocking any traffic from the server to the rest of your home. You can always allow ssh from your work env to the server, but block unsolicited traffic from the server to your home. I’d also suggest potentially leveraging a secondary public IP if you have service that will give you a block of IP addresses for a fee. It would be worth it to just keep your home separate from any denial of service type attacks directed at your lemmy instance.

you cannot prevent communication between clients within the same VLAN.

Can't you use a firewall for this?

Anyway, my guess is it's probably better to use a separate vlan or a DMZ for that. But given my poor security experience, others can probably better help you on this one

Yeah, the usual approach is to create a DMZ network/VLAN where you forward external traffic to, but you can’t reach anything except the internet from.

Is just exposing it via a Cloudflare Zero Trust tunnel enough for security?

(Serious question that I don't know the answer to, as this is what I'm currently considering for a project.)