You're missing the easiest option of them all: Cloudflare tunnels. You don't have to open any ports, your friends don't need to install extra software and it's free. I don't know about the TOS but I wouldn't worry to much because it's only a couple of friends.
Self-Hosted Main
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.
For Example
- Service: Dropbox - Alternative: Nextcloud
- Service: Google Reader - Alternative: Tiny Tiny RSS
- Service: Blogger - Alternative: WordPress
We welcome posts that include suggestions for good self-hosted alternatives to popular online services, how they are better, or how they give back control of your data. Also include hints and tips for less technical readers.
Useful Lists
- Awesome-Selfhosted List of Software
- Awesome-Sysadmin List of Software
VPN or reverse proxy
Tailscale
Isn’t that his second option? Do you have to give others access to your network and login to use the apps? Or how does it work?
I suspect your friends probably don't need access to your whole media stack.
What parts they do need access to, and from what type of devices, will determine the best approach.
Headscale/tailscale
Only one which can update policies on android.