perhaps a stupid question, but are there bridges for XMPP ? My impression is that XMPP is as good as empty (I do use it mainly as a federated service). Is there still a lot of active development on the XMPP side of things?

I do not understand your point with ‘you cannot change the URL’. If you use matrix as non-federated and just the only user, what is the problem that you need to change the URL when you need to set up a new server on a new URL? Not being able to change the server at the same URL seems like a logical concequence of authentication, be it for server-to-server communication as for client-to-server communication.

I run a small setup on a seperate server segment (2nd router behind my main router) so it is on the internet. I run nextcloud, an dendrite and conduit instance (matrix chat-server servers), a mastodon and go-to-social instance (fediverse), bitwarden (password manager), and others.

If there is a service that you do not want to be publically accessable by everybody but you do want to access from everywhere on the internet yourself, check out client-side TLS (https) certificates. The server does is accessable from the internet put only people who have a TLS certificate on their client signed by you can access it. For services that do not require incoming connections from other machines (e.g. nextcloud, bitwarden, … but no federated services like matrix-chat or the fediverse) that is a very good option to protect your servers.