You could do tailscale shared nodes and share just your jellyfin servers that way.

They kind of lost me at piping a script to sh. Is this the official way? Get your shit packaged into the popular distros. DevOps isn’t that hard.

If you like certbot, you should check out Caddy. Fully auto tls so long as the server resolves to a set domain name. Caddy-docker-proxy is pure magic with docker containers.