I don’t disagree, and I am one of the VPN advocates you mention. Generally there is no issue with exposing jellyfin via proxy to the internet.
The original question seemed to imply an over-secure solution so a lot of over-secure solutions exist. There is good cause to operate services, like jellyfin, via some permanent VPN.
I would not publicly expose ssh. Your home IP will get scanned all the time and external machines will try to connect to your ssh port.
Over the top for security would be to setup a personal VPN and only watch it over the VPN. If you are enabling other users and you don’t want them on your network; using a proxy like nginx is the way.
Being new to this I would look into how to set these things up in docker using docker-compose.
You have a mini sword breaker. It’ll be fine…
Edit: autocorrect…
If you wanted to go overboard, don’t even make the server accessible publicly. Distribute keys to a Wireguard network that is accessible publicly. Mandate your players obtain keys from you to play.
I would not just default to exfat because it is “newer,” it does have compatibility issues on non-windows systems. The implementations differ wildly.
Veracrypt. Make a file on your disk.
Don’t want a storage file?
Make 2 partitions, put veracrypt portable exe on the first normal storage partition. (fat32 is likely ideal here) Second partition formatted with veracrypt.
You asked a question and someone offered a suggestion you were not looking in the right place. Then you become incredulous at their suggestion and start asking a whole bunch of sarcastic questions implying relevancy.
How about you google you problem and figure it out? No one will help you with that attitude.
I transcode to ramdisk.
Dockge - https://github.com/louislam/dockge
Docker compose with webui and upgrade button.