I rent a cheap $5/mo VPS and use it to run a wireguard server with wgeasy and nginx proxy manager. Everything else runs on my home server connected by wireguard.

Use a reverse proxy (caddy or nginx proxy manager) with a subdomain, like myservice.mydomain.com (maybe even configure a subdir too, so …domain.com/guessthis/). Don’t put anything on the main domain / root dir / the IP address.

If you’re still unsure setup Knockd to whitelist only IP addresses that touch certain one or two random ports first.

So security through obscurity :) But good luck for the bots to figure all that out.

VPN is of course the actually secure option, I’d vote for Tailscale.

Wireguard VPN to my fritzbox lets me access my jellyfin.

I use a VPS and a wiregusrd tunnel.

https://codeberg.org/skjalli/jellyfin-vps-setup

I don't host my media outside my local network but, if I did, I would use my go to method of SWAG with Authentik. This is what I have done for my other self-hosted items.

I'm just using caddy and a cheap $2 a year .top domain with a $4 a month VPS. Works for my users, I only have 3 users on my server.

I just install tailscale at family houses. The limit is 100 machines.

This is my setup.

Read more, here.

I use a cloudflare tunnel, ISP won't give me a static IP and I wanna keep my firewall locked down tight.

Cheap VPS with Pangolin for Wireguard and reverse proving through the tunnel.

Tailscale, with nginx for https.

Very easy, very simple, just works, and i can share my jellyfin server with my friends

Tailscale - funnel

Just that