I use nginx proxy manager and expose it behind a subdomain entry on cloudflare (though you can use any DDNS service i bet). NPM handles the security so I get HSTS and HTTPS on Plex and Jellyfin without either needing it set themselves.

From there anyone can access Jellyfin/Plex via my subdomains (plex.mydomain.com or watch.mydomain.com at the mo)