Your basic requirements are:

• Some kind of domain / subdomain payed or free;
• Home ISP that has provides public IP addresses - No CGNAT BS;
• A dynamic DNS service such as https://freedns.afraid.org/;
• Configure your router to forward your jellyfin port to the server.

The working principle is: your home has a dynamic IP address that might change at any time. You’re going to use a dynamic DNS service do to have a domain name that always points to the correct IP. To accomplish this you’ll be required to install a small tool in your server that monitors your public IP and whenever it changes calls the dynamic DNS service with the update. The best part is that you don’t even need to own a domain for that.

There’s a nice explanation of how caddy reverse proxies work here. https://caddy.community/t/using-caddy-as-a-reverse-proxy-in-a-home-network/9427

Essentially you setup your router to port forward any new incoming connections to Caddy, which then decides what to do with them according to the configuration (Caddyfile).

Even simpler: Your local network is like a castle, inside is a safe and secure place where your devices communicate freely. Your router is a firewall around the castle, by default it blocks incoming connections. This is good because the internet is scary. By port forwarding you allow a door in the firewall which leads to Caddy, which is like a guard. Caddy asks them what they want, and if they say e.g. jellyfin.example.com, then it sets up an encrypted connection with https to your local jellyfin server. If they want anything else they aren’t allowed in.

There’s plenty of reasons why you would not want to have a Jellyfin server be publicly available (even behind authentication). It’s simply not a well-secured system at this point (and may not get there for a long time, because it’s not a focus).

I strongly suggest keeping it accessed via VPN.

But note that VPN access is not necessarily any slower than “publicly” serving the HTTPs directly, at least not by much.

If you don’t already use Wireguard as the protocol, then maybe consider running a wireguard VPN instead, that tends to be quicker than classic OpenVPN.

And last but not least: a major restricting factor in performance of media servers from afar is the upload speed of your ISP connection, which is very often much lower than your download (100Mbit/10Mbit are common here, for example, so only 10% of the speed up than down).

Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:

[Thread #241 for this sub, first seen 25th Oct 2023, 10:45] [FAQ] [Full list] [Contact] [Source code]

I assume you have a dynamic ip. what I did for that scenario: setup a dyndns hostname somewhere, configure a subdomain (e.g. jellyfin.example.com) with a cname dns record pointing to the dyndns hostname. you will have to setup updating of the dyndns hostname, this can be done in the fritz box and port forwarding to your jellyfin pc.