Subdomains
jellyfin.domain → correct internal service
Readable URLs
Reverse proxy maps subdomains to internal services and enforces HTTPS. It’s the clean interface between the public internet and your private homelab.
TLS
HTTPS everywhere (certs on the VPS).
Encryption in transit
Access Control
Auth, allowlists, and minimal exposure.
Only what you need