Other than Navidrome (which is probably your best option right now), I also use AzuraCast. It’s essentially an internet radio playing my playlists 24/7 that I (or anyone, but I obviously don’t just share it with strangers) can listen to from anywhere.
I’ve had great success with this script. It’s a script that makes a Wireguard tunnel between your local network and the VPS, so no opening of ports at home needed. It’s made for Oracle VPS though, but it’d probably work elsewhere too.
My current setup is this:
Cloudflare DNS -> Caddy (VPS) -> Wireguard tunnel -> NginxPM (Home) -> services
You can just have the Wireguard tunnel go straight to docker though.
Tailscale, and a Cloudflare Tunnel going to Nginx Proxy Manager. So all three, in a way.
I use all three.
CF tunnels to access generic apps I want public.
Tailscale to have remote access to my home network.
Wireguard tunnel going to a VPS for apps that I don’t feel comfortable running through CF due to the bandwidth (Jellyfin, AzuraCast).
I totally could move everything that’s on CF tunnels over to Wireguard, but I see no need to do it. Cloudflare is trustworthy enough and I like the additional protection it offers.