I expose my jellyfin to 80 via nginx. Other services stay not exposed, and only available on my local network. I don't bother with tailscale.