I don't open mine up to the internet. Instead I set up a wireguard vpn, and any time my devices are not on my home network they autoconnect to wireguard, and then have access to jellyfin and other services I host internally.

This generally works well unless I want to share my jellyfin with a friend or try to airplay to a TV outside of my network.