First it's a VM because I'm not going mess around with stuff on bare metal.

Containerisation method doesn't matter, the point is to have an untrusted container (VM, thin container, LXC, whatever) that a process cannot exit, has no root user rights, and can be limited externally for what resources it sees.

The entire point is to be able to say "here's your config folder where you can write shit, but not execute; here's the data folder where you can neither write or execute shit; and here's the read-only executable layer of the image/VM/container".

Create docker is a can of worms because you have to pick a reverse proxy software like nginx, traefik, caddy. Which means you need to understand all three to know which to pick.

Regardless how you're hosting it, a reverse proxy is necessary. Even with a VM.

Here's a fun fact: Caddy and Traefik both come with ways to easily configure all the necessary things via Docker container labels. I need about 3-4 labels per container to set up the subdomain I need, the port I want to forward to it, and the security level (auth, crowdsec, etc.)

Then there's setting up the certificate with the dns provider.

Uh what? ACME makes it a literal one line configuration. Two if you include the DNS host scoped token.

So I got nginx working with a certificate but gave up after the VM running Jellyfin couldn't see it. Googling showed someone on Reddit with the same problem but no answer other than others saying "works for me".

So the problem wasn't Jellyfin but you not being able to follow a dead simple guide. And to think you were running a whole ass ISP...