Don't proxy jellyfin through CF.
Using it for the domain or subdomain is fine.

You know it's not proxied because the cloud is gray instead of yellow.
And if you ping the domain it's your own IP instead of a cloudflare ip.

If you don’t want to open any ports, then you will need to setup a VPN service. Tailscale is one of the easiest to use VPNs out there.

Have you thought about using DuckDNS.org?

I run mine through them (it’s free) because I couldn’t work through using my own hosting since my host makes things super complicated.

Just attempting to setup pihole + some DNS rules for this, but can't yet say it works cause I haven't gotten that far

Maybe look into Tailscale. At the end of the day, someone needs to open up the ports, but Tailscale does it strictly to negotiate a VPN connection between two devices, so they don’t see the traffic that goes over the tunnel.

Don't expose Jellyfin to the internet