That sucks, good to know.

Looks like creating a VPN is the only option for securing jellyfin.

Not unless the reverse proxy adds some layer of authentication as well. Something like HTTP basic auth, or mTLS (AKA 2-way TLS AKA client certificates)

For nginx: https://docs.nginx.com/nginx/admin-guide/security-controls/configuring-http-basic-authentication/

so if I add a user ”john” with password “mypassword” to video.example.com, you can try adding the login as: “https://john:mypassword@video.example.com”/

Most HTTP clients (e.g. browsers) support adding login like that. I don’t know what other jellyfin clients do that.

The other option is to set up a VPN (I recommend wireguard)