Poorly designed, high functioning automations.
I had pfSense running on an old Core 2 Duo machine from around 2010 when I worked in MSP. You can run it on just about anything.
The only trouble I had was when I switched to gigabit+ service and had snort running. Snort is single-threaded and that CPU just could not keep up. Suricata would be a better choice given it’s natively multi-threaded, but the real limitation there was my setup and not pfSense.
Bob Saget would roll in his grave if he heard about your addiction.
Having the game on the horizon is actually a very good position for the employees for two reasons:
Pre-orders. Rockstar already secured $3 billion, so they don’t have the argument that compensation is unfair (why they were wanting to unionize to begin with along with work hours).
(The big one) Pre-Launch Strike. There still is a LOT of damage that could be done to GTA6 especially given the pre-orders. If they strike before November, GTA6 would go without day 1 patches. Whatever state it is in prior to strike is how it will stay during the highest review and revenue period for the game. It would mess with marketing and potentially even push off release by months which would hit their stock price hard.
If the goal is doing this in a simple fashion, then use Tailscale funnels (https://tailscale.com/docs/features/tailscale-funnel). Funnels automate the process and act as a reverse proxy into specific servers within your tailnet.
The downside is there is no authentication to funnels, so whatever you’re running (Jellyfin in this case so that’s not an issue) needs it’s own authentication setup. You might consider running fail2ban on that machine and have it watch for login attempts, but otherwise that is the simplest setup I think you could do.