I just hosted it as a docker container, exposed the ports and setup a white list.

Never had an issue with it. I have a domain already for other stuff i host, so just created a play..com which can be used behind non proxied cloudflare. I have the docker restrictions pretty limited though so just enough for it to run basically and running from a non root user. I think in most cases this would be fine. White list will stop randoms from joining unless that persons account gets compromised. I also run backups as well just in case something does happen, that role based on activity. All of these are easily done and available in docker making supporting it easy, as well as utilities like Rcon etc, these obviously I don't expose.

Grafana. Have alerts set up and get data with node exporter and cadvisor with some other containers giving some metrics.

I have alerts setup and they just ping me on a discord server I setup. High cpu and temps low disk space memory things like that. Mostly get high CPU or temp alerts and that's usually when plex does its automated things at 4am.