You make good points here for the beginner however there are better alternatives and solutions for basically everything you mentioned here. The biggest I want to address is conflicts on your system. Generally running servers on metal is just outright bad practice. Containerize. Always containerize. There are lots of great options. Docker, podman, Lxc, helm, flatpak… hell. Snap if you must. Running servers on metal is generally is just asking for trouble unless the system’s entire purpose is for that. Also the cg-nat situation. Personally been behind it for a few years but it’s not a problem as long as you have a reverse proxy tunnel in place. Not a hard fix at all.

If you like 1.1.1.1 the. You should try 9.9.9.9. Or better yet host unbound pihole if you’re up to the challenge. Best dns experience I’ve had.

Tons of good responses here. I’m surprised that nobody has brought up Tailscale though. It’s def the easiest vpn solution I have found. It’s got some great documentation and how to projects to get a home lab running and it’s got its own domain system baked in most of it being zero configuration. You can access mullvad vpn exit nodes straight from it, and set up those domains with ssl super easy e.g.

sudo tailscale serve —https=443 localhost:8096

That single command would allow any other devices connected to your Tailscale account to reach your Jellyfin using the domain “{serverhostname}.[tail-scale].ts.net” complete with a private reverse proxy and ssl cert.

There are a few things to click around in tailscale on but it’s a extremely easy to use free application that has made my self hosted life significantly easier due to my system living behind multiple firewalls that I sadly have no control over.