Are your exposed services all on their own ports externally, or behind a reverse proxy?

Putting them behind a reverse proxy makes sure that attackers at least need to know the correct hostname to access your service.

This is security by obscurity which isn’t proper security but it means that all of the port scanners out there likely won’t know your jellyfin server exists when a vulnerability for jellyfin is released.

If you use let’s encrypt or something similar be aware that all issues certs show up in a public log so attackers like to harvest that log as a list of valid domain names. Switch those certs to wildcards so that you aren’t advertising those valid hostnames.

There are often options in reverse proxies, or sometimes your router to do geo based blocking. If you can limit connections to your local country only you eliminate huge portions of the botnets out there.

Combining this with auto updates/reboots on your services is probably enough to keep you safe, but if you want to really secure things a separate DMZ vlan for your services to prevent an attacker from compromising additional services on your LAN.

The more network segmentation you can do the better. An ideal setup is every app/container in its own network/ACL that only allows traffic to the specific network devices that it needs to talk to. This is a lot to manage if you do this with your router/vlans. Containers orchestrators (i.e. k8s) make this easier, but don’t protect you from kernel level exploits to break out of the containers. I believe proxmox has VM level ACLs now so you could skip the vlans and do your segmentation at that level instead.