Some apps now have support for client certs (home-assistant ❤).
Nextcloud is one of the only apps that’s open without client ssl because it’d be highly inconvenient to share a file link with someone if I had to install a cert on their devices.
Plex app never works right for me so I just use the browser. My TV is too old to have old built-in so I have a VM in which I use a browser to watch plex.
Yes it’s running in my reverse proxy.
Nginx is doing my “client ssl verify” in front of my web services.
You can even do this on a per uri/location.
For example, my nextcloud is open without client certs so I can share files with people, but the admin settings path is protected by client ssl.