The goal was simple to state and easy to get wrong: a media library that works from anywhere, without opening a single port on the home network to the public internet. Jellyfin is the server piece — open-source, self-hosted, and running on the same workstation box that holds the ~28TB library — but the access model is the part that actually matters.
Tailscale, built on WireGuard, is what makes the remote-access story work without port forwarding. Every device — phone, tablet, TV — joins the same private mesh network instead of reaching the server through a public-facing address. There is nothing for a scanner on the open internet to find, because nothing is exposed to it.
Hardware transcoding on the workstation is what keeps that practical at a 28TB scale with multiple device types. Without it, a 4K file playing back on a phone over a slower connection would mean either re-encoding in software (and burning CPU) or the playback just failing — hardware transcoding handles that conversion in real time without bottlenecking the machine.
Tailscale's MagicDNS gives the server a stable hostname inside the mesh, so devices reconnect to the same address rather than chasing a changing local IP. That stable name is also what makes the player apps simple to set up on Fire TV, Android TV, and mobile — point them at the MagicDNS name once and they keep working.
Notes for next time: a private mesh network for access is a stronger default than exposing a service and trying to harden it afterward. No open port is simpler to reason about than a hardened open port, and it removes an entire category of problem before it starts.