One thing that I do, though it may not be as secure as a reverse proxy is just using tailscale funnel to expose my jellyfin instance.

I’d like to learn a self-hosted SSO but time is my least abundant resource at the moment.