Don’t expose jellyfin to the internet is a golden rule.

That’s never made sense to me; why build an authn frontend instead of just clicking your user if the security is just an illusion anyways. “Use a VPN” is fine for a mainframe, but an active project in 2026 should aspire to be better.

Unfortunately, not everyone is tech-literate enough nowadays to understand how a VPN works, nor do they want to

Isn’t it easier to set up a VPN than expose it to the internet?

and then you are giving access to your lan to people whose computer you don’t control and might be full of malware.

You only have to give them access to a specific port on a specific machine, not your entire LAN.

My VPN has a ‘media’ usergroup who can only access the, read-only, NFS exports of my media library.

If you’re just installing Wireguard and enabling IP forwarding, yeah it would not be secure. But using a mesh VPN, like Tailscale/Headscale, gives you A LOT more tools to control access.

yeah but even with plain wireguard the peers can be limited. you just have to figure out the firewall rules, or use opnsense as your wireguard server because it figures the harder part out for you.