A viable concern if you wanted to put it public-facing. If you only care about syncing when you’re home, though, you should be able to host it perfectly fine just not giving any pathways in from the outside world.
If you wanted to use the Android application, you would have to learn about TLS certificates anyway, because it doesn’t work without HTTPS.


I’m personally using Let’s Encrypt and duckdns.org for a completely free solution.
Currently only hosting everything on my local network though with VPN to access when not at home.