If the goal is doing this in a simple fashion, then use Tailscale funnels (https://tailscale.com/docs/features/tailscale-funnel).
Funnels automate the process and act as a reverse proxy into specific servers within your tailnet.

The downside is there is no authentication to funnels, so whatever you running (Jellyfin in this case so that's not an issue) needs it's own authentication setup. You might consider running fail2ban on that machine and have it watch for login attempts, but otherwise that is the simplest setup I think you could do.