Self-hosters keep hitting the same wall: they want to let non-technical relatives stream from their media server remotely, but every option forces a bad trade. Mesh VPNs (Tailscale, NetBird) are secure but make grandma install and log into a client. Cloudflare Tunnel is the easy zero-client path, but its CDN terms still restrict serving video and large files it doesn't host, which a proxied media server can trip. And a bare reverse proxy works with the native apps but leaves Jellyfin exposed to the internet (the thread's 'not very secure'), while the Authelia-style auth layer you would add to secure it breaks those same native apps. The opening is a self-hosted tunnel that hands out one simple URL plus login, stays secure by default, and keeps the native apps working.
builder note
The wedge isn't another mesh VPN. It's the 'give a normal person a link' layer: a self-hosted tunnel that presents one URL plus a simple login, stays secure by default so you aren't exposing Jellyfin raw, and critically keeps the native apps working (the Authelia-style auth wall they can't traverse is the trap). Cloudflare's no-client UX is the bar to beat, and its CDN restriction on serving video it doesn't host is the opening a purpose-built, self-hosted media tunnel can exploit.
landscape (5 existing solutions)
Every option forces a trade. VPN/mesh tools (Tailscale, NetBird) are secure but make each non-technical viewer install and log into a client. Cloudflare Tunnel is the easiest zero-client path but its CDN terms still restrict serving video it doesn't host, which a proxied media server can trip. And a bare reverse proxy works with the native apps but leaves Jellyfin exposed, while the auth layer that would secure it breaks those apps. No product gives a self-hoster a shareable link plus simple login that is both secure by default and survives Jellyfin's native clients.