For my travel devices, I use Tailscale to talk to the server. For raw internet, I use their funnel feature to expose the service over HTTPS. Then just have fail2ban watching the port to make sure no shenanigans or have the entire service offlined until I can check it.
You could try using Open WebUI (https://docs.openwebui.com/) and setup ollama with smollm2:135m (https://ollama.com/library/smollm2) on the backend. Then you’d just have to pass the equation with step-by-step mentioned.