Stick with the VPN. No point in exposing more services with possible security vulnerabilities.
this post was submitted on 09 Oct 2023
28 points (88.9% liked)
Selfhosted
38768 readers
106 users here now
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.
Rules:
-
Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.
-
No spam posting.
-
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.
-
Don't duplicate the full text of your blog or github here. Just post the link for folks to click.
-
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
-
No trolling.
Resources:
- awesome-selfhosted software
- awesome-sysadmin resources
- Self-Hosted Podcast from Jupiter Broadcasting
Any issues on the community? Report it using the report flag.
Questions? DM the mods!
founded 1 year ago
MODERATORS
I love Jellyfin but I would absolutely not make it accessible over the public internet. A VPN is the way to go.
Yeah I'm thinking maybe just have family sign up for tailscale.
Why not just run your own WireGuard instance? I have a pivpn vm for it and it works great. You could also just put jellyfin behind a TLS terminating reverse proxy.
Sounds like a pain to get non technical family members to use. If you're willing to break the non web app you could always put it behind an authenticating proxy (which is what I do for myself outside of VPN, setting up a VPN on a phone is obnoxious and I only look at metadata anyway on my phone)
Or headscale, works like a charm
Why not just run your own WireGuard instance?
CGNAT is a big reason.
Yep, that way you can set ACLs, you they can only access the jellyfin ports + the ports you allow them to.
Also, tailacale DNS.
The fact that tailscale has google/apple/etc logon integration will also help.
Why "absolutely" not?
Have you seen the link?
Oh, sorry, sorry, sorry, i didn't think this is a link 😅😅😅
Haha, no problem!
Oof, that's bad... And lazy
Unfortunately a lot of these issues are architectural issues inherited from Emby
If you are not behind a CGNAT, it should be as easy as opening the necessary ports.
I have a reverse proxy running in ports 80, 443 and can safely access Jellyfin on a subdomain without issues from outside my LAN.
Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I've seen in this thread:
| Fewer Letters | More Letters |
|---|---|
| CGNAT | Carrier-Grade NAT |
| DNS | Domain Name Service/System |
| NAT | Network Address Translation |
| SSL | Secure Sockets Layer, for transparent encryption |
| TLS | Transport Layer Security, supersedes SSL |
| VPN | Virtual Private Network |
5 acronyms in this thread; the most compressed thread commented on today has 8 acronyms.
[Thread #204 for this sub, first seen 9th Oct 2023, 21:05] [FAQ] [Full list] [Contact] [Source code]
To get it outside the LAN, you just need to forward the port it uses in your router. Example 8096 for regular http requests. I would highly recommend getting at least a reverse proxy with an SSL cert.
Depends on your definition of safe.
If you do a public port forward and set up basic security and proper SSL its safe from the majority of people.
You can but it will cause security issues. You will need to buy a domain and setup a SSL proxy with https to proxy traffic in. After than I would lock down you firewall rules and make sure that a compromise can't escape the isolated environment.
Also make sure you docker container is hardened against excaping as it will improve security when a security hole is discovered in jellyfin