With regards to keeping the service behind a VPN, I have a few questions:

1. How do you deal with various devices (Roku, Smart TVs, ...), as most don't seem to have VPN apps for them?

2. How do you deal with airplay? My ipad can VPN to my home network and access jellyfin when I am away, but Airplay doesn't work, as the stream isn't available to the device I am streaming to.

My jellyfin (and navidrome) on my home server has me very happy with the basic set up. Both are internal only, as the only service I expose is wireguard. But I haven't solved the two issues above, which also keeps me from being able to share my jellyfin with my family.