• universally recognized TLS certs via Let’s Encrypt. DNS challenges are the way to go - you don’t even have to expose your HTTP server

Just a note, as we’ve had this discussion before: DNS ACME challenges will publish the FQDN of every service you encrypt to a public record, which some sites will scrape up. Just in case this bothers some people.

I had a similar setup; Wireguard connecting a VPS to my home network. I use Jellyfin, but I setup an nginx proxy manager on the VPS to handle external requests and forward them to my private server. All that matters is you open the appropriate ports on your VPS to the NPM instance.