If you dont want to open your network ports, you could setup an amazon aws or something (or firebase, disclaimer im a firebase torch/fan) to allow control from outside your house
It's a command queue that allows your Raspi/Arduino to listen to commands and your control apps to issue them. I use secret keys for the commands, but you can also use crypto to sign the requests. It's been working very well for me, and with very low latency (the DNS query and TLS setup are the slowest parts, it seems).
