Protect pangolin webinterface from internet?

[VinterSolen]

Hi, what is the best way to protect the actual pangolin webinterface for settings and such?

I just realized that mine will be accessible over internet, since pangolin.domain.ext points to my VPS ip.

I have a newt to home lan, if that helps to limit pangolins surface area some how?

I have a strong password set and a totp 2fa on the account