Optimal way to host Jellyfin server for me & my friends?

[FiGeMu]

Hey folks,

My current Jellyfin setup is very sub-optimal. It's just hosted on my gaming pc, and my friends just connect directly to an open port on my dynamic IP.
Recently however, I've gotten a new pc that is supposed to become my always-on home media server, and wanted to properly set up Jellyfin. I've got two primary concerns/ questions/ requirements that i would like advice with.
I'm concerned about my ISP / other organizations (stichting BREIN in my case) seeing what's going on on my server / what I'm streaming to my friends outside of my home network. 
Would a VPN be all i need to obfuscate / circumvent this? What about IP whitelisting?
I'd also like to make it as hassle free as possible for my friends to use the server. Currently they just connect directly to my IP in whatever app they're using, but when this changes they have to enter the new IP. Is there a way for them to just enter it once and never worry about it again?

Thanks in advance, if more information is needed please ask.
Sorry if this is the wrong place to ask, I'm still not very experienced with self hosting.

[TheDreadPirate]

Setting up https would be sufficient to prevent anyone from seeing the traffic other than the intended recipient. Same with a VPN, but that would require that all clients support having a VPN installed. Roku and Android TV clients would not be able to run a VPN most likely.

[FiGeMu]

Setting up https would be sufficient to prevent anyone from seeing the traffic other than the intended recipient.  Same with a VPN, but that would require that all clients support having a VPN installed.  Roku and Android TV clients would not be able to run a VPN most likely.

Hey, thanks for your advice. Is there a way for me to share Jellyfin without my freinds having to update the ip every time it changes?

[Duvel]

You have nothing to worry about your ISP in the Netherlands which is a friendly-torrenting and everything else country.
as pirate said, you should only allow https traffic on your jellyfin and your ISP cant see anything about the traffic contain. They can just see that theres some volume you upload to your friends, but cant know what at all.

If you want to stay on an IPadress and not have your own domain, you should either activate/pay an option at your ISP to have a static IP adress or subscribe to a service like dyndns (there are a lot of others). A bit too long to explain this in details here. Google is your friend.

My personal feeling is that it might not be a good idea to do all this if you dont understand what you are doing, which is apparently the case :-) When you open ports on your router it means anyone can enter your network and reach your PC... its OK if you secure everything right but that requires knowledge. The world is now full of villains (which are 99.99% bots), scanning and trying to enter on everything not secured correctly. You have been warned

[Drake97]

Setting up https would be sufficient to prevent anyone from seeing the traffic other than the intended recipient.  Same with a VPN, but that would require that all clients support having a VPN installed.  Roku and Android TV clients would not be able to run a VPN most likely.

Hey, thanks for your advice. Is there a way for me to share Jellyfin without my freinds having to update the ip every time it changes?

The public IP that my isp gives me is also dynamic and changes every time and what I did in the end is to acquire a ddns service which takes the changing IP and updates itself, in this case I have it with no-ip with
In this case, for example your IP is 123.456.789, you mask it for example with mysuperip.dds.net and that last "URL" is the one that your friends should enter and it will always "change" automatically and they should not manually enter the IP every time it changes, I hope it is understood.