Just in case, if you have jellyfin facing the web, jellyfin is not very secure, it has some vunurabilities unpatched for like forever I personally would recommend hiding it behind the VPN, and making it available to everyone at home Or as minimum or a good practice create locations in nginx to block for example logins outside of the VPN or house So to login you need to be at home.or connected to the VPN (useful if you have other people using your services, so they they they can login at home, but continue using everything outside)