I too would like to know more. Jellyfin has been something that I am still heditating to expose online without a VPN.

I have Plex behind a reverse proxy (HAproxy) with Crowdsec and firewall rules all behind Cloudflare. My firewall rules in HAproxy block access a few different ways, like if request are higher then 60 requests a second, or if there is strange path traversal. Used the following guide as a start.

https://www.archy.net/building-a-native-fail2ban-with-haproxy-stick-tables/