I've recently created a relatively simple smart Christmas tree which is a Raspberry PI Zero W powered LED strip.
In order to control it via IFTTT webhooks, I've started a lightweight flask server on the Raspberry Pi - on a specific port with several endpoints for different animations/patterns. Then, on the home router, I've configured port-forwarding to the flask server started on the Raspberry Pi.
Currently, the flask API is completely open, - though, one, in order to use it, would need to know the IP address and the port values.
The risks in terms of security in this particular case are, of course, minimal, but what are the general ways to improve the security of this home automation setup? Should I go for a full-fledged web server like Apache?
I was thinking to at least require a "secret" key in a cookie, which the IFTTT recipes and the flask server would only know. Since the resources of the device are limited, I guess, performance & security need to be carefully balanced.