This is one of my more complex web sites. The web server is Apache running under WSL (Ubuntu) on a Windows 11 laptop in Spain. The following was neccessary to get it all working (with a LOT of help from ChatGPT):
Forward external traffic from Windows to WSL for ports 80 & 443 and open the Windows firewall for both ports. Write a PowerShell script to recreate this setup on reboot.
Forward ports 80 & 443 on the router to the Windows laptop.
On my johnburch.co.uk BIND9 DNS server (located in a shed in the UK with a static IP address), add an A record for spain.johnburch.co.uk with the Spanish router's current IP address. Installed LetsEncrypt and generated a SSL certificate for https://spain.johnburch.co.uk
As I don't have a static IP address in Spain, write a script to check the current IP address and if it has changed, update the BIND9 zone file for spain.johnburch.co.uk with the new IP address using nsupdate. Setup a TSIG key for BIND9 and this script to allow nsupdate to securely update the zone. Set a CRON job, running every 5 minutes, to run this script.