Also docker repo but mainly because I use Jeff Geerlings ansible role for installing docker. I pin the version, so it’s not really much different from using the Debian repo

Thanks! Any suggestions for WAF options? At the moment I just have nginx with fail2ban

Why do you need a reverse proxy? You don’t need one to access Jellyfin externally. People use them to simply fit access when running more than one service.

I’d get it up and running locally first before trying it on a vps.