Not really. Personally I’d allow the service account running jellyfin only access to read media files to avoid accidental deletion but otherwise no.

Also, jellyfin docs have a sample proxy config. You should use that. It’s a bit more in depth than a normal proxy config.

Honestly, if you know nginx just stick with it. There’s nothing to be gained by learning a new proxy.

Use Mozilla’s SSL generator if you want to harden nginx (or any proxy you choose)- https://ssl-config.mozilla.org/

Which they expressly said they wanted in the comment I responded to…

Personally I’d recommend restic and backblaze b2 if I were you. Dedup and quick.