Topic per title, basically.
For me: after setting up all the integrations and fall overs using the arr stack and Jellyfin (inc Sabnzdb etc)… I keep circling back to Nova video player.
https://github.com/nova-video-player/aos-AVP/releases
It’s arguably not even self hosting…but there something undeniably cool about sticking a USB stick into a router, installing a single app on your TV and boom, done. EDIT: of course, it can consume the *arr stack, integrate with Ombi etc
IOW, I really like stuff that simple to set up and punches above its weight class.
With a reverse proxy there’s no need for hoops unless you add some authentication mechanism on top of that. I use reverse proxies for several things so that they flow through filtering like crowdsec or fail2ban. It just routes the single port to the device on question as is. The idea is to make it indistinguishable from a fully exposed port to the user. Just have to make sure whatever system runs the reverse proxy is secured. I always make sure that nothing significant is on the system that is exposed to the internet other than the reverse proxy server and all other ports are closed internally and externally. Ideally a device that has multiple Ethernet ports works well so you can keep an ssh port open on the internally facing ethernet port for troubleshooting. Nice if they are 2.5Gbit or 10Gbit ports, too, since they route a lot of traffic. But not needed.