I use wireguard directly instead of tailscale. Not sure what router you’re using, but mikrotik support it out of the box. I am sure they are not the only ones. My phone runs on it 24/7 and has access to the rest of my services.

I haven’t setup nextcloud, so can’t give any advice on that. Immich was insanely easy to setup though.

I like navidrome, but I am not using jellyfin, so I have nothing to compare it with.