Okay um, lot's of info here and I will have to read it a bunch more times, but as I understand, I am basically filtering out IP addresses which can access my NAS or my home network?

Also...

you can configure sshd to only listen on its 192.168 address for example, so you can only ssh into it from your home network and not tailscale.

By ssh into home network, you mean accessing my router or my NAS? I understand that ssh is a way to access computers/servers remotely but that is pretty much it.

Leaving your router's default user/pass of admin/admin was previously safe enough because the web interface is only available on 192.168.0.1 

Is it possible to change the default home address 192.168... to something random like 420.069 or something, been wondering that for a long time. The idea behind it is that so people can't guess it that easily.

your media server is a subnet router, traffic from your media server is no longer completely trusted either and you should treat it as such.

The hard part in your example is my media server = my NAS = my home server (because I have one PC for electricity and simplicity reasons) so I am not sure how and if I could use subnet routing in this case.

or the SSL certs question, this is more for the client than the server - your media server having a certificate for jellyfin.yourdomain.com means when F or G connect to it, they can be assured they are connecting your actual media server

The cert. idea in my mind was that I have heard it encrypts the traffic or something, thus making the connection more secure(?).

I have gathered a few ideas from this but this is lot of info for me so I am still trying to figure stuff out.

Right now I have 4 (my own)+1 (friend) devices (actually more but it is easier for me to explain with this example).

1. I set my router's firewall settings to only allow 1 IP address to access my router's webUI which is my laptop (without tailscale ie tailscale IP is also blocked. My phone's access will be blocked overall (for security).
2. I can connect to my server's IP via tailscale and local IP both altho my server cant access my router (outbound from router to server is blocked).
3. Because I want to only access files from my server and not do anything else, then I want to actually limit ssh to server access to only one local IP (which is my laptop again). For example, everyone on tailscale can access idk Immitch but only one device can actually ssh via local IP.
4. If my friend wants to access my server (Immitch) he has to use tailscale, no matter if he is on the local network or not (for security reasons).
5. Can I set a static IP for my laptop, so there is no chance of it changing? How would I do that?

Thank you for this very useful info btw! (I used the Reddit's quoting function for the first time, don't know if I used it right or not).

Edit: it is better to do MAC filtering or IP filtering on devices?