Tailscale has a generous free account and runs on windows, mac, IOS, android, apple TV, firestick, and shield. You just set it up on your media server and every client, and just use to 100. address for your server in each client.

If you need Roku,LG,Samsung, it’s no longer fun. The tailnet can be forwarded from a routed device on the network, but that’s deep in the weeds for random people.

You could install HAProxy and run let’s encrypt, forwarding your JF to an external port (ISPs usually block 443, but it’s not hard to tell the client what port you need. Then your users can just specify your home IP and a specific port.

Or you could forgo the SSL and just open JF up on a high port. Maybe fail2ban on logins. it’s REALLY not ‘good’ at remote access :)