While you are (probably?) correct, this is significantly beyond what is required to deploy Plex for a standard home server chump like me.

I’m using jellyfin and a few others, but am consciously putting off exposing these services to the web until I can learn enough about security to do so. Given life, this will probably take me the better part of a year…