The safest (but not as convenient) way is to run a VPN, so that the services are only exposed to the VPN interface and not the whole world.
In pfsense I specify which services my OpenVPN connections can access (just an internal facing NGINX for the most part) and then I can just go to jellyfin.homelab, etc when connected.
Not as smooth as just having NGINX outward facing, but gives me piece of mind knowing my network is locked down