

Actual answer for 3:
- put jellyfin behind a proper reverse proxy. Ideally on a separate host / hardware firewall, but nginx on the same host works fine as well.
- create subdomain, let’s say sub.yourdomain.com
- forward traffic, for that subdomain ONLY, to jellyfin in your reverse proxy config
- tell your relatives to put sub.yourdomain.com into their jellyfin app
All the fear-mongering about exposing jellyfin to the internet I have seen on here boils down to either
- “port forwarding is a bad idea!!”, which yes, don’t do that. The above is not that. Or
- “people / bots who know your IP can get jellyfin to work as a 1-bit oracle, telling you if a specific media file exists on your disk” which is a) not an indication for something illegal, and b) prevented by the described reverse proxy setup insofar as the bot needs to know the exact subdomain (and any worthwhile domain-provider will not let bots walk your DNS zone).
(Not saying YOU say that; just preempting the usual folklore typically commented whenever someone suggests hosting jellyfin publicly accessible)
OK, add step above: use wildcard certificate for your domain.
Terminating the TLS connection at your perimeter firewall is standard practice, there’s no reason your jellyfin host needs to obtain the certificate.