This is how I started.
I have a dynamic IP and a router provided by my ISP. IP assignations, DHCP, are managed by the router. I went with DuckDNS for a free DNS service. Select a name and you get a myname.duckdns.org that you need to assign to your dynamic IP. duckdns has instructions to create a cronjob to update your dynamic IP on duckdns.org. (Routers come in all shapes and configs, chances are that this won’t work for most people) On the router, I assigned a static IP to the server hosting Jellyfin, in case of a reboot Jellyfin would always have the same IP. On the Ports page I opened up the default port for Jellyfin at that IP. I could then access Jellyfin outside of my local network using myname.duckdns.org:1234
This is not what I have right now, but it helped my get started.

What is MOTD?

I’d say you install the VPN on the home machine, then when you turn on tailscale on your phone, the traffic should be Phone->home machine (exit node)->VPN

I have a very similar setup. I work from home and use a tablet with symphonium for radio and my personal collection. When I’m in the car since I don’t have Android Auto, I just connect my phone with the Bluetooth. And I use tailscale as the VPN.

Some of us have kids who absolutely love dangling wires

Great for self-hosting if its something you use. Not really a homelab thing, these two things are not necessarily the same either. My hosted services for the family are entirely segregated from my lab, which does a very different job.

My thoughts exactly. OP should look for something else to host on the homelab, there’s plenty out there.

Clever. I’m just starting to mess with Caddy. Been struggling with Vaultwarden lately and your solution might fit my needs.

I think this should be talked about more. Does every selfhosted app need to be public facing?
I use Immich as a backup service, so i really don’t have any need to have it public facing. It connects when I’m home. Same with contacts/calendar.