left_is_best

Tailscale is a pretty good option if said old people have an Android or Apple TV, not sure about availability of Tailscale on any other OSs. Run it on your server and the TV client, grab the Tailscale IP from the dashboard and enter [Tailscale IP]:[Jellyfin port] when the Jellyfin app asks for the server address. You could homebrew a VPN too. Only other option would be a domain name and a reverse proxy.

Oh, it sure as hell was.

A semi-automated whitelist solution would be nice. I’ve settled for Crowdsec with very strict automatic banning behavior.