The problem is bots

Id you don’t like it, get a VPN or consider replacing your government.

They should need to get a warrant, but that doesn’t sound too hard in this instance.

Going public usually makes everything worse.

You can setup separate vlans, or even separate networks for allowing the ads if you need.

For local testing: build and run tests on whatever computer I’m developing on.

For deployment: I have a self hosted gitlab instance in a kubernetes cluster. It comes with a registry all setup. Push the project, let the cicd pipeline build, test, and deploy through staging into prod.