Seconding Jellyfin. I installed Tailscale on all my devices, including the media server, to achieve free remote playback without worrying about trying to secure the server against the whole Internet.
Same setup here, pretty nifty. I’d like to setup a reverse proxy inside the Tailscale network but I haven’t figured that out yet.
I'm no expert, but I think you could have the reverse proxy node be the only thing whitelisted to be accepted by the nodes you want behind the proxy (via their tailscale IP). I believe this would all be done in their ACL JSON.
Tailscale offers a super basic reverse proxy called tailscale serve. Or baring that caddy has built in support. They have the full details for both in the tailscale docs.