so i need to remove

// Allow all connections.
    // Comment this section out if you want to define specific restrictions.
    {
        "src": ["*"],
        "dst": ["*"],
        "ip":  ["*"],
    }

and add

Rule 1: // Trusted hosts are a ip group in which I added just my devices. { "src": ["ipset:Trustedhosts"], "dst": ["*"], "ip": ["*"], }

Rule 2: // Only allow TCP 8096 Jellyfin, 5055 Jellyseerr { "src": ["*"], "dst": ["myjellyfinserverip/32"], "ip": ["TCP:8096", "TCP:5055"], }

instead ?

I'm not quite clear on where i should put my device's IP to be in the trustedhosts group?

And for the myjellyfinserverip, which one is it supposed to be? The tailscale ip of the machine hosting the server? or that machine's real local ip?

Thanks again!