Earlier quoted context omitted.
You should absolutely hand off the security to something else - just exposing this publicly is asking to get hacked. I use Wireguard for my private online stuff, that works nicely. Expose Jellyfin only on the loopback address and use Nginx to forward your domain to it, then setup your DNS entry to be the VPN address of your server. Just be aware that if you have your own local DNS server then you might need to config…
Can you easily use your services on mobile devices that way? I currently reverse proxy every service I need through nginx, but I kinda feel like this isn't enough security-wise. I did blacklist most countries and don't expose any port other than 80+443. Does it require you to run a VPN app on your phone constantly and does that cause troubles?
It's not ideal, since the password's obviously saved in any user's browser history, but it's less of a pain than dealing with a VPN, especially since I let friends use the server, and it's secure enough for my threat model.