TheHolm

for start private keys should never leave the system which uses them. Wildcards are even worse, as if one host got compromised, all others can be spoofed.

Just do not use wildcard, very bad security practice. Getting individual cert for each service is easy these days.

Why? Why anyone needs online version?

IMHO Jellyfin is processing everything it sent to clients. So I do not think it possible to put it behind SDN( may be it possible if server side transcoding is off) Please define slow. Slow on what part? It should be like 250ms RRT to your server which is not much for web-based apps.

Yes. Always. Unless you prefer FreeBSD

It just REST API, use restic for example.