Not every self-hosted app needs to be exposed directly to the public internet. But many projects become more useful when they have stable inbound reachability. If CGNAT is the blocker, NeedPorts can provide the public endpoint and forwarded ports.
NeedPorts is a networking layer. It does not install or manage these projects for you. What it can do is solve the public reachability problem when your machine is behind CGNAT and normal port forwarding does not work.
Jellyfin, Plex, Nextcloud, and Immich are examples of self-hosted projects where public reachability can matter, depending on how you want to access them.
Gitea, Forgejo, code-server, and small self-hosted APIs often benefit from a stable public endpoint when they need remote access or webhook traffic.
SSH, Syncthing, Vaultwarden, Home Assistant, and other self-managed services may need reliable inbound reachability depending on your setup.
Projects like Paperless-ngx and other utility services can benefit when you need to reach them directly from outside your local network.
If a project is only used inside your own LAN, or you are already happy with a private overlay network like Tailscale for purely private access, public port forwarding may not be necessary. NeedPorts is most useful when the real need is a public endpoint.
If you want the broader context, read the self-hosting guide, the homelab guidance, and the CGNAT explainer.