Is keeping everything inside of a local “walled garden”, then exposing the minimum amount of services needed to a WireGuard VPN not sufficient?

There would be be no attack surface from WAN other than the port opened to WireGuard

Whoogle is a good option for self hosting as well

Yes. It’s a tech/ nerd bubble here.

This

Yeah, just me. Not available externally without VPN access.

None, I self host Whoogle.

All of mine are working. For some you might need to enable to compatibility mode, which disabled some of the added exploit protections provided by GOS.

The one piece is reeeeaaaaal.