How to secure Jellyfin hosted over the internet?
-
I use Pangolin (https://github.com/fosrl/pangolin)
Uhh, interesting! Thanks for sharing.
-
conditional Auto-Connect. If not on home wifi, connect to the tunnel.
You don't need this with Tailscale since it uses a separate IP range for the tunnel.
I also have a different subnet for WG. Not sure I understand what you're saying...
-
I just stay connected to wireguard even at home, only downside is the odd time I need to chromecast, it needs to be shut off.
I can stay connected, still works, but I don't think I need the extra hoops.
-
I think that breaks most clients
? How does putting something before it break it? It most certainly doesn’t.
-
? How does putting something before it break it? It most certainly doesn’t.
Clients are built to speak directly to the Jellyfin API. if you put an auth service in front it won't even ask you to try and authenticate with that.
-
I already host multiple services via caddy as my reverse proxy. Jellyfin, I am worried about authentication. How do you secure it?
Mostly via empty threats
-
No, it isn't.
I wouldn't say "great" it's ok software. Not even due to all of those security things which is a nightmare too. They do things like break the search speed months ago and not have any idea why, it's so insanely slow and on top of that it somehow lags the entire client when searching too, not just the server which is the only thing doing the query. Lots of issues just with that.
-
Oh boy. Nope. My friends gonna have to fiddle with a VPN, forget exposing JF to the outside...
-
CloudFlare tunnel with Zero Trust, plus their bot and abuse blocking. Users can get in with the right oauth, plus only allowed from the countries I know they're in. Then just their username and password on jellyfin.
-
For me it's always been busted both on AOSP and Miui/HyperOS...
Works great and has been for some time on my P7P.
Ensure you've allowed background usage and turn off manage app if unused.
Keep the notification on and allow notifications.
-
if the cameras don’t load, open Tailscale and make sure it’s connected
I've been using Tailscale for a few months now and this is my only complaint. On Android and macOS, the Tailscale client gets randomly killed. So it's an extra thing you have to manage.
It's almost annoying enough to make me want to host my services on the actual internet....... almost... but not yet.
If you make Tailscale your VPN in Android it will never be killed. Mileage may vary depending on flavor of Android. I've used this on stock Pixel and GrapheneOS.
Under Settings > Network and internet > VPN
Tap the Cog icon next to Tailscale and select Always-on VPN.
-
For web access, stick it behind a reverse proxy and use something like Authentik/Authelia/SSO provider of your choice.
For full access including native clients, set up a VPN.
I use Tailscale right now. Which, in fairness, I didn't state in the post. However, I was hoping to share it more similarly to how I used to with Plex. But, it would appear, I would have to share it through Tailscale only at this point.
-
My setup:
- Locally (all in docker)
** JF for managing and local access
** JF with read only mounted volumes that uses the network of my Wireguard client container
** Wireguard client opening a tunnel to Wireguard server on VPS
** Ping container regularly doing pings to Wireguard Server so the connection stays up (didn't manage it otherwise) - VPS (Oracle Cloud free tier)
** Caddy as a reverse proxy with https enabled and geolocking (only certain countries are allowed to connect to)
** fail2ban to block IPs that try to bruteforce credentials
** Wireguard server
So my clients just get the URL of my reverse proxy and can access the read only JF through my Wireguard tunnel. Didn't have to open any ports on my side. If someone is interested I can share the docker compose files later.
I'm more interested in the fail2ban setup. How did you do that for Jellyfin? Is it through a plugin?
- Locally (all in docker)
-
I hate the cloudflare stuff making me do captchas or outright denying me with a burning passion. My fault for committing the heinous crime of using a VPN!
Skill issue
-
Some of these are bonkers. The argument not to fix them because of backwards compatibility is even wilder. Which normal client would need the ability to get data for any other account that it hasn't the Auth token for.
Just make a different API prefix that's secure and subject to change, and once the official clients are updated, deprecate the insecure API (off by default).
That way you preserve backwards compatibility without forcing everyone to be insecure.
-
Doesn't streaming media over a cloudflare tunnel/proxy violate their ToS
They prohibit large amounts of media being streamed, and they reserve the right to suspend or terminate accounts for it. Multiple years in, that has not happened.
Edit: here, you can read https://blog.cloudflare.com/updated-tos/
-
Using cloudflare tunnels means nothing is encrypted and cloudflare sees all.
Oh no they'll see I'm watching TNG
-
My users aren't going to figure that out.
-
My users aren't going to figure that out.
-
They'd have to connect to it, and possibly reconnect. That aspect is the issue.
