Self-hosting is empowering when you match paranoia to threat. This module is not fear-mongering — it is a sane baseline before you forward ports or invite friends to your jellyfin instance.
Ask: Who might attack me, with what effort, and what do they want? A random bot scanning the internet cares about weak SSH and default passwords. A targeted adversary is a different game. Most home users need good hygiene: updates, unique passwords, 2FA on email and router admin, and minimal exposure.
TLS encrypts bytes in transit and helps prove you reached the server you think you did (via certificates). On the public internet, HTTPS is standard. On a trusted LAN, some homelabbers use HTTP internally and TLS only at the edge — but anything crossing untrusted networks should be encrypted.
Tools like Let’s Encrypt automate certs for public hostnames; local setups often use self-signed certs or internal CAs until you wire a proper domain.
Instead of opening a dozen services to the internet, many people run one VPN (WireGuard, Tailscale, etc.) into home, then access internal IPs as if they were on the LAN. Fewer attack surfaces, same convenience when done right.
Coffee Home will keep gaining tiles and integrations. You now have vocabulary to place each piece: network, storage, services, and safety.