

It depends on what service - some, like Jellyfin, are accessed only from home IPs which are static (for music through Jellyfin I use offline mode to prevent too much mobile traffic), so I can add those specific IPs in the whitelist. Otger services I need to access from elsewhere, and I can add entire subnets (i.e. for my phone carrier network or VPN servers). Those change once in a while and that is annoying. Other services I want publically available.
Jellyfin especially still has some unsecured endpoints where it would be wise to take some.extra precautions. I think the risk some people seem to think this poses is a little overblown (i.e. rights holders finding your instance and reverse mapping your entire library and suing you to oblivion), but better not risk it.









I’ve been running tge AIO container for several years now and it is running perfectly fine. I only enable whatever I use, so for instance no Collabora.
But for Collabora, while it should be good for single-person use, if you require some kind of collaborative simultaneous work, you should probably set up the high-performance backend. I did this at work for a NC-instance hosted via Hetzner and it works well when we tried it, but we don’t really use those kinds of tools much in our daily work.