How to secure Jellyfin hosted over the internet?
-
No, it isn't.
I wouldn't say "great" it's ok software. Not even due to all of those security things which is a nightmare too. They do things like break the search speed months ago and not have any idea why, it's so insanely slow and on top of that it somehow lags the entire client when searching too, not just the server which is the only thing doing the query. Lots of issues just with that.
-
Oh boy. Nope. My friends gonna have to fiddle with a VPN, forget exposing JF to the outside...
-
CloudFlare tunnel with Zero Trust, plus their bot and abuse blocking. Users can get in with the right oauth, plus only allowed from the countries I know they're in. Then just their username and password on jellyfin.
-
For me it's always been busted both on AOSP and Miui/HyperOS...
Works great and has been for some time on my P7P.
Ensure you've allowed background usage and turn off manage app if unused.
Keep the notification on and allow notifications.
-
if the cameras don’t load, open Tailscale and make sure it’s connected
I've been using Tailscale for a few months now and this is my only complaint. On Android and macOS, the Tailscale client gets randomly killed. So it's an extra thing you have to manage.
It's almost annoying enough to make me want to host my services on the actual internet....... almost... but not yet.
If you make Tailscale your VPN in Android it will never be killed. Mileage may vary depending on flavor of Android. I've used this on stock Pixel and GrapheneOS.
Under Settings > Network and internet > VPN
Tap the Cog icon next to Tailscale and select Always-on VPN.
-
For web access, stick it behind a reverse proxy and use something like Authentik/Authelia/SSO provider of your choice.
For full access including native clients, set up a VPN.
I use Tailscale right now. Which, in fairness, I didn't state in the post. However, I was hoping to share it more similarly to how I used to with Plex. But, it would appear, I would have to share it through Tailscale only at this point.
-
My setup:
- Locally (all in docker)
** JF for managing and local access
** JF with read only mounted volumes that uses the network of my Wireguard client container
** Wireguard client opening a tunnel to Wireguard server on VPS
** Ping container regularly doing pings to Wireguard Server so the connection stays up (didn't manage it otherwise) - VPS (Oracle Cloud free tier)
** Caddy as a reverse proxy with https enabled and geolocking (only certain countries are allowed to connect to)
** fail2ban to block IPs that try to bruteforce credentials
** Wireguard server
So my clients just get the URL of my reverse proxy and can access the read only JF through my Wireguard tunnel. Didn't have to open any ports on my side. If someone is interested I can share the docker compose files later.
I'm more interested in the fail2ban setup. How did you do that for Jellyfin? Is it through a plugin?
- Locally (all in docker)
-
I hate the cloudflare stuff making me do captchas or outright denying me with a burning passion. My fault for committing the heinous crime of using a VPN!
Skill issue
-
Some of these are bonkers. The argument not to fix them because of backwards compatibility is even wilder. Which normal client would need the ability to get data for any other account that it hasn't the Auth token for.
Just make a different API prefix that's secure and subject to change, and once the official clients are updated, deprecate the insecure API (off by default).
That way you preserve backwards compatibility without forcing everyone to be insecure.
-
Doesn't streaming media over a cloudflare tunnel/proxy violate their ToS
They prohibit large amounts of media being streamed, and they reserve the right to suspend or terminate accounts for it. Multiple years in, that has not happened.
Edit: here, you can read https://blog.cloudflare.com/updated-tos/
-
Using cloudflare tunnels means nothing is encrypted and cloudflare sees all.
Oh no they'll see I'm watching TNG
-
My users aren't going to figure that out.
-
My users aren't going to figure that out.
-
They'd have to connect to it, and possibly reconnect. That aspect is the issue.
-
My setup:
- Locally (all in docker)
** JF for managing and local access
** JF with read only mounted volumes that uses the network of my Wireguard client container
** Wireguard client opening a tunnel to Wireguard server on VPS
** Ping container regularly doing pings to Wireguard Server so the connection stays up (didn't manage it otherwise) - VPS (Oracle Cloud free tier)
** Caddy as a reverse proxy with https enabled and geolocking (only certain countries are allowed to connect to)
** fail2ban to block IPs that try to bruteforce credentials
** Wireguard server
So my clients just get the URL of my reverse proxy and can access the read only JF through my Wireguard tunnel. Didn't have to open any ports on my side. If someone is interested I can share the docker compose files later.
- Locally (all in docker)
-
I already host multiple services via caddy as my reverse proxy. Jellyfin, I am worried about authentication. How do you secure it?
Tailscale is awesome. Alternatively if you're more technically inclined you can make your own wireguard tailscale and all you need is to get a static IP for your home network. Wireguard will always be safer than each individual service.
-
Just make a different API prefix that's secure and subject to change, and once the official clients are updated, deprecate the insecure API (off by default).
That way you preserve backwards compatibility without forcing everyone to be insecure.
Even just basic API versioning would be sufficient. .NET offers a bunch of ways to handle breaking changes in APIs
-
They prohibit large amounts of media being streamed, and they reserve the right to suspend or terminate accounts for it. Multiple years in, that has not happened.
Edit: here, you can read https://blog.cloudflare.com/updated-tos/
Cloudflare is known for being unreliable with how and when it enforces the ToS (especially for paying customers!). Just because they haven't cracked down on everyone doesn't mean they won't arbitrarily pick out your account from thousands of others just to slap a ban on. There's inherent risk to it
-
Clients are built to speak directly to the Jellyfin API. if you put an auth service in front it won't even ask you to try and authenticate with that.
Sorry, when out of the house I only use web not clients.
-
I already host multiple services via caddy as my reverse proxy. Jellyfin, I am worried about authentication. How do you secure it?
Kinda hard because they have an ongoing bug where if you put it behind a reverse proxy with basic auth (typical easy button to secure X web software on Internet), it breaks jellyfin.
Best thing is to not. Put it on your local net and connect in with a vpn
