Self-hosters keep hitting the same wall: they want to let non-technical relatives stream from their media server remotely, but every option forces a bad trade. Mesh VPNs (Tailscale, NetBird) are secure but make grandma install and log into a client. Cloudflare Tunnel is the easy zero-client path, but its CDN terms still restrict serving video and large files it doesn't host, which a proxied media server can trip. And a bare reverse proxy works with the native apps but leaves Jellyfin exposed to the internet (the thread's 'not very secure'), while the Authelia-style auth layer you would add to secure it breaks those same native apps. The opening is a self-hosted tunnel that hands out one simple URL plus login, stays secure by default, and keeps the native apps working.
The wedge isn't another mesh VPN. It's the 'give a normal person a link' layer: a self-hosted tunnel that presents one URL plus a simple login, stays secure by default so you aren't exposing Jellyfin raw, and critically keeps the native apps working (the Authelia-style auth wall they can't traverse is the trap). Cloudflare's no-client UX is the bar to beat, and its CDN restriction on serving video it doesn't host is the opening a purpose-built, self-hosted media tunnel can exploit.
landscape (5 existing solutions)
Every option forces a trade. VPN/mesh tools (Tailscale, NetBird) are secure but make each non-technical viewer install and log into a client. Cloudflare Tunnel is the easiest zero-client path but its CDN terms still restrict serving video it doesn't host, which a proxied media server can trip. And a bare reverse proxy works with the native apps but leaves Jellyfin exposed, while the auth layer that would secure it breaks those apps. No product gives a self-hoster a shareable link plus simple login that is both secure by default and survives Jellyfin's native clients.