I did a 4 node Pi4 kubernetes cluster for about 5 years. The learning experience was priceless. I think most notable was learning to do proper multiarch container builds to support arm and x86_64. That being said, about half a year ago I decided to try condensing it all into two n100 nuc-like clones and keep one pi as the controller. For me and my apps and use cases there was no going back. Performance gains were substantial and in this regard I think I was hobbling myself after the educational aspect plateaued.

There have been a few mentions of Navidrome. I find it works well for sharing at an album or even artist level. It can do playlists as well. But you must explicitly choose what to share, at which point it’s generates a unique URL and will generate a web player and zip if you enable the option to download.

You can, of course, just make user accounts and distribute credentials.

If you’re needing to offer browsable folders to easily copy, basically a filesystem-like experience, it’s probably not the best tool.

Edit: one more thing to point out is that navidrome, jellyfin, and airsonic all construct music libraries differently. Navidrome is using tags, jellyfin uses file names, airsonic uses directory structure. Not sure about Plex.

I’ve had a good experience so far with two minipcs, mele quieter 4c for kodi, and a morefine m9 (I think this one is branded as mipowcat in the EU). They’re both n100, the m9 can go up to 32gb of ram although it is picky about what modules it will accept. I use the m9 for jellyfin and about 10 other services. Quick sync works great as far as I’ve tested it. For jellyfin I’m relying mostly on direct streaming, but I tried a few episodes with forcing some transcoding by using Firefox for playback and it worked fine.

I feel like the argument for using a nonstandard ssh port these days is that you dodge the low tier automation/bots that are endlessly scanning IPs and port 22 and trying obvious usernames and passwords. I do also question how much it is worth dodging these since presumably you’d have already done the other basics like key only and no root login before this. Maybe there’s some value if you want a clean auth.log or equivalent