Selfhosted

If the goal is doing this in a simple fashion, then use Tailscale funnels (https://tailscale.com/docs/features/tailscale-funnel). Funnels automate the process and act as a reverse proxy into specific servers within your tailnet.

The downside is there is no authentication to funnels, so whatever you're running (Jellyfin in this case so that's not an issue) needs it's own authentication setup. You might consider running fail2ban on that machine and have it watch for login attempts, but otherwise that is the simplest setup I think you could do.

What you want is Tailscale. The downside of Tailscale is that you have to connect to a VPN to access your services, the advantage - it is so easy to set up on the server it feels like magic.

I have setup NetBird with Authentik. Netbird is on a VPS and authentik on my home server.

NetBird allows to expose a service through a subdomain. Or you can use the netbird client as a VPN and allow peer to peer connection.

I forward my port to my bastion host, and reverse tunnel to it when I want to access my stuff.

My router allows you to set a device in the DMZ zone which will let you use your routers IP as its address.

There are things like duckdns if you cannot get a static IP, but there are also things like wireguard.

Look into nginx proxy manager. Pretty easy to setup and deploy.

You can still just open it to the internet. Just do it on IPv6 instead. You won't find it by scanning IP ranges like they do on IPv4. You'll want to set up DNS for it though. Also get a free TLS cert from LetsEncrypt. It's a bit of work initially.

This is how I started.
I have a dynamic IP and a router provided by my ISP. IP assignations, DHCP, are managed by the router. I went with DuckDNS for a free DNS service. Select a name and you get a myname.duckdns.org that you need to assign to your dynamic IP. duckdns has instructions to create a cronjob to update your dynamic IP on duckdns.org. (Routers come in all shapes and configs, chances are that this won't work for most people) On the router, I assigned a static IP to the server hosting Jellyfin, in case of a reboot Jellyfin would always have the same IP. On the Ports page I opened up the default port for Jellyfin at that IP. I could then access Jellyfin outside of my local network using myname.duckdns.org:1234
This is not what I have right now, but it helped my get started.

Domain and vps pointed to your ip. Or if behind cgnat reverse proxy to vps

I mean not for free, but I did it for cheap. A good domain can cost you $5 a year, and you simply route your jellyfin to a sublevel like watch.mydomain.com

Fun part is you can also route your sonarr like sonarr.mydomain.com

Device -> VPN Tunnel (ideally WireGuard) -> Home Router / Server.

The only port that needs to be opened is your WireGuard server which typically is :51820.

The issue with this is you have explain VPN’s and WireGuard to people which, in my experience turns people away as they see it as a hassle.

Alternatively buy a domain, setup DDNS so that your home IP is associated with your domain, setup a reverse proxy and open port :443 on your router however, I would suggest a blacklist-first approach and only whitelist the few known IP’s you can trust.

Netbird or tailscale

WireGuard