Yeah, it’s on my to-do list for my domain registrar, but the above was in relation to OPNsense configuration, which I found a solution for.

It does sound exactly like this. However, I’m concerned about following these instructions when my external IP isn’t static. I still have yet to set up DDNS (I believe is the term, for automatically updating my domain’s DNS servers with whatever new IP address my ISP gave me), but this looks like it’s entirely IP driven.

EDIT: Actually, I just realized OPNsense has an alias for that, so I’m not sure why their own manual didn’t recommend it. I can just set the value to “WAN address”. It works! That’s step #1 down, and now I’m curious about step #2.

My local DNS only seems to set up IP address routing, so I’m not sure how to hit my reverse proxy with the subdomain I’m interested in and have it route accordingly; or even just skip the reverse proxy by having that URL internally route to an IP address and port, because there’s nowhere to put in a port.

Yes, that’s exactly what I’ve done. You still haven’t shown me why it’s unsafe. If you can’t, that’s fine. At some threshold or another, nothing is secure. The one thing I know for sure is that that first page, that says it doesn’t recommend exposing a port, does not say what you said it does.

Probably the number one recommendation I see in self hosting communities is to not open ports directly (other than for a reverse proxy). It seems like a common recommendation no matter the service. To be clear: I am a beginner. I know very little about this, but I’ve spent months learning. I can’t say you’re wrong, but I don’t think you’ve made a convincing argument for me to actually understand why Jellyfin is unsafe to expose to the internet compared to any other service.

It says exposing a port directly to the internet is not recommended; do you know of any project that would recommend directly exposing a port? What is meaningfully different here?

By all means correct me if you know more, but what I tend to see is one or two people here saying that Jellyfin devs don’t recommend exposing it publicly, only to be corrected by looking at the actual documentation. I suspect those cautioning against it are on outdated information and that Jellyfin carries much the same risk as exposing any other service.