Ghost is self-hostable, easy-to-use, and looks beautiful. (Good) themes are usually a one-time payment, and they definitely have photoblog ones.
I use both Ghost and Wordpress for my sites and, while it’s not as infinitely customizable as Wordpress, Ghost is also not as needlessly complex, vulnerable, or time-intensive.
I use a reverse proxy so I can just use a hostname and not need a port. I run Jellyfin that way no problem, function-wise.
Additionally, not having a domain won’t necessarily protect you since you do have people out there scanning for ports and when they see 8096, they’re going to immediately know it’s a Jellyfin/Emby server and any vulnerabilities associated with those. If you use a reverse proxy, they only see 443 which is…pretty much every other site on the internet. That’s security through obscurity, I know, but it will help mitigate some of the easier attacks.
I’ll say that everything I have to have a port open for (mostly game servers) gets targeted by the internet at large despite the fact that I’ve published the address and port absolutely nowhere online and only shared it with close friends. I almost never get anyone trying to log in to my other services.