You might want to try out Tailscale. It’s a mesh network overlay that you can either share easily within your tailnet or out to the greater internet with funnel (sorta like cloudflare tunnels, but somewhat better at respecting privacy). It’s also possible to self host the controller, so you don’t have to depend on a third party.

You could do tailscale shared nodes and share just your jellyfin servers that way.

If you like certbot, you should check out Caddy. Fully auto tls so long as the server resolves to a set domain name. Caddy-docker-proxy is pure magic with docker containers.