Is my self-hosted Jellyfin setup reasonably safe to expose to the internet?

Written with the assistance of AI:

I’m looking for a sanity check from people who know networking/security better than I do. I’m not trying to make this Fort Knox; I just want to know whether I’ve covered the major risks or done anything stupid.
My setup:
Proxmox host on my home network
Jellyfin running in its own unprivileged LXC container
Separate LXC running Caddy
Jellyfin itself is not directly port-forwarded to the internet
Router forwards only TCP 80/443 to the Caddy container
Caddy reverse-proxies https://jf.example.com to Jellyfin over the LAN
DNS is through Cloudflare
Cloudflare proxy/CDN is not being used for the Jellyfin video traffic; it’s DNS-only
Caddy handles the public TLS certificate/HTTPS
HTTP redirects to HTTPS
Dynamic public IP, so the Caddy container runs a small Cloudflare DDNS script using an API token
Cloudflare API token is scoped only to the permissions needed to update the relevant DNS zone/record
Token is stored locally on the Caddy container rather than embedded in public config/code
DDNS runs periodically via a systemd timer
Jellyfin has normal username/password authentication
Proxmox management, SSH, SMB/NAS shares, etc. are not intentionally exposed to the internet
I also use Tailscale for administrative/private access, but I want family members to be able to use Jellyfin without needing a VPN.
The eventual plan is split DNS so jf.example.com resolves to the Caddy LAN address while I’m home and the public address while away. That way clients use the same hostname/HTTPS certificate everywhere, but local video traffic doesn’t need to hairpin through the WAN.
Threat model is basically ordinary home-server stuff: automated internet scanning, credential stuffing, Jellyfin/Caddy vulnerabilities, someone compromising the exposed container and trying to move laterally, etc. I’m not particularly worried about defending against a determined targeted attacker.
Questions:
Is Caddy → Jellyfin with only 80/443 exposed a reasonable way to do this?
Are there meaningful benefits to putting Caddy/Jellyfin on a separate VLAN from the rest of the LAN?
If Jellyfin gets compromised, how much should I assume an attacker can do from an unprivileged LXC?
Should the Jellyfin container have read-only access to the media library rather than read/write?
Is there anything important I should be doing at Caddy — rate limiting, CrowdSec/fail2ban, IP restrictions, security headers, etc.?
Any particular Jellyfin settings/accounts I should lock down?
Is my Cloudflare DDNS arrangement creating any significant additional attack surface?
Anything obviously dumb here that I’m overlooking?
I’m primarily looking for practical risk reduction rather than adding twelve layers of enterprise security to a home media server.
Please feel free to tell me exactly what you’d change.