beets.io with the discogs plugin has never failed me. If its on discogs you will get tags

purelymail.com Cheap and never had a problem wirh them.

Antennapod also has an option to skip the first X seconds of a pod and the last X seconds. It’s really useful when an episode starts with 3 minutes of ads.

All IMO of course but I think you’d only be on the hook legally for using Jellyfin if you sold access to your server. A private server would never hit the radar in a million years. The bad thing about exposing ports is you’re giving access to a service and therefore you’re relying on the Jellyfin authentication system to be secure. If there are flaws then, at best, someone could watch your content (and possibly delete it depending on your JF config) and at worst they could escalate privileges to get access to the hosting server and do whatever they want on your network. Like I said, I ran it on docker behind traefik (as the reverse proxy) and had no concerns doing so. I would much rather have the slight extra hassle of Jellyfin over Plex because I didn’t want the Plex middle-man sat between me and the person consuming the content. Jellyfin is a direct connection and there’s an app on Roku so it met all my needs.

Its easy with Jellyfin and the config will tell you if its set up right. You can either go directly to the Jellyfin port or thru a reverse proxy but either way you’re exposing ports. I ran mine behind docker so I could easily keep everything up to date.