Yes that’s why I suggested a alternative. Although wireguard is simpler to setup initially. Using proxy’s and exposing your service directly is simpler for the end user. Both are not difficult to do.

Its not hard to setup a proxy and use a full SSL cert. A little bit more complex but much simpler for the rest of the family.

Wireguard is also very simple to setup. This would allow you to share other services you host in the future in a secure way as well.

Installing jellyfin is as easy as setting up any self hosted thing though… Just use docker compose if you want simplicity.

Perhaps urbackup? She might not be the most pretty girl but works like s charm. It works on window, Linux and I do believe Mac as well.

I know you can run openwrt as a VM on a NAS. Might be a good solution for you. Theoreticaly you can use virtual interfaces and bridges on the NAS to use a single fysical network interface. But a second card will be the most easy option