How to secure Jellyfin hosted over the internet?
-
No, it isn't.
Oh boy. Nope. My friends gonna have to fiddle with a VPN, forget exposing JF to the outside...
-
Oh the Quick Toggle has never, ever worked correctly. I hoped they fixed it after the UI refresh update but unfortunately not yet.
What device/ROM are you using?
It's been very iffy for me on and off from Miui > HyperHyperOS, but just checking now?
Works fine
Like I say, the foreground notification seemed to be the lifeline to some of us using it and keeping it alive, even after IIRC some more restrictions came in with future versions of Android (forgive me, I'm very lazy these days and just skim Mishaal's TG feed
)? -
What device/ROM are you using?
It's been very iffy for me on and off from Miui > HyperHyperOS, but just checking now?
Works fine
Like I say, the foreground notification seemed to be the lifeline to some of us using it and keeping it alive, even after IIRC some more restrictions came in with future versions of Android (forgive me, I'm very lazy these days and just skim Mishaal's TG feed
)?For me it's always been busted both on AOSP and Miui/HyperOS...
-
For me it's always been busted both on AOSP and Miui/HyperOS...
Huh. The nearest I have to an actual "AOSP" device is my King Kong Cubot phone that has probably the cleanest version of "stock Android" I've ever seen, and I'm going to presume you mean like a Google Pixel / Graphene etc?
Tailscale and the QS tile / notification was solid on that Cubot but to be honest, I've barely turned it on these days and is now one of those drawer phones.
Miui / HyperHyperOS though is a different kettle of fish and exempting Tailscale from its App lel Killer does seem to work. 70-80%ish.....
But there is something that just fuggs up and I to like I say turn it off/on like most thingys I own
-
I already host multiple services via caddy as my reverse proxy. Jellyfin, I am worried about authentication. How do you secure it?
For web access, stick it behind a reverse proxy and use something like Authentik/Authelia/SSO provider of your choice.
For full access including native clients, set up a VPN.
-
CloudFlare tunnel with Zero Trust, plus their bot and abuse blocking. Users can get in with the right oauth, plus only allowed from the countries I know they're in. Then just their username and password on jellyfin.
Using cloudflare tunnels means nothing is encrypted and cloudflare sees all.
-
I already host multiple services via caddy as my reverse proxy. Jellyfin, I am worried about authentication. How do you secure it?
My setup is:
Proxmox - restricted LXC running docker which runs jellyfin, tailscale funnel as reverse proxy and certificate provider.
So so don't care about jellyfin security, it can get hacked / broken , its an end road. If so i will delete the LXC and bring it up again using backups. Also i dont think someone will risk or use time to hack a jellyfin server.
My strategy is, with webservices that don't have critical personal data, i have them isolated in instances. I don't rely on security on anything besides the firewall.
And i try not to have services with personal sensitive data, and if i do, on my local lan with the needed protections. If i need access to it outside my local lan, vpn. -
I use Pangolin (https://github.com/fosrl/pangolin)
Uhh, interesting! Thanks for sharing.
-
conditional Auto-Connect. If not on home wifi, connect to the tunnel.
You don't need this with Tailscale since it uses a separate IP range for the tunnel.
I also have a different subnet for WG. Not sure I understand what you're saying...
-
I just stay connected to wireguard even at home, only downside is the odd time I need to chromecast, it needs to be shut off.
I can stay connected, still works, but I don't think I need the extra hoops.
-
I think that breaks most clients
? How does putting something before it break it? It most certainly doesn鈥檛.
-
? How does putting something before it break it? It most certainly doesn鈥檛.
Clients are built to speak directly to the Jellyfin API. if you put an auth service in front it won't even ask you to try and authenticate with that.
-
I already host multiple services via caddy as my reverse proxy. Jellyfin, I am worried about authentication. How do you secure it?
Mostly via empty threats
-
No, it isn't.
I wouldn't say "great" it's ok software. Not even due to all of those security things which is a nightmare too. They do things like break the search speed months ago and not have any idea why, it's so insanely slow and on top of that it somehow lags the entire client when searching too, not just the server which is the only thing doing the query. Lots of issues just with that.
-
Oh boy. Nope. My friends gonna have to fiddle with a VPN, forget exposing JF to the outside...
-
CloudFlare tunnel with Zero Trust, plus their bot and abuse blocking. Users can get in with the right oauth, plus only allowed from the countries I know they're in. Then just their username and password on jellyfin.
-
For me it's always been busted both on AOSP and Miui/HyperOS...
Works great and has been for some time on my P7P.
Ensure you've allowed background usage and turn off manage app if unused.
Keep the notification on and allow notifications.
-
if the cameras don鈥檛 load, open Tailscale and make sure it鈥檚 connected
I've been using Tailscale for a few months now and this is my only complaint. On Android and macOS, the Tailscale client gets randomly killed. So it's an extra thing you have to manage.
It's almost annoying enough to make me want to host my services on the actual internet....... almost... but not yet.
If you make Tailscale your VPN in Android it will never be killed. Mileage may vary depending on flavor of Android. I've used this on stock Pixel and GrapheneOS.
Under Settings > Network and internet > VPN
Tap the Cog icon next to Tailscale and select Always-on VPN.
-
For web access, stick it behind a reverse proxy and use something like Authentik/Authelia/SSO provider of your choice.
For full access including native clients, set up a VPN.
I use Tailscale right now. Which, in fairness, I didn't state in the post. However, I was hoping to share it more similarly to how I used to with Plex. But, it would appear, I would have to share it through Tailscale only at this point.
-
My setup:
- Locally (all in docker)
** JF for managing and local access
** JF with read only mounted volumes that uses the network of my Wireguard client container
** Wireguard client opening a tunnel to Wireguard server on VPS
** Ping container regularly doing pings to Wireguard Server so the connection stays up (didn't manage it otherwise) - VPS (Oracle Cloud free tier)
** Caddy as a reverse proxy with https enabled and geolocking (only certain countries are allowed to connect to)
** fail2ban to block IPs that try to bruteforce credentials
** Wireguard server
So my clients just get the URL of my reverse proxy and can access the read only JF through my Wireguard tunnel. Didn't have to open any ports on my side. If someone is interested I can share the docker compose files later.
I'm more interested in the fail2ban setup. How did you do that for Jellyfin? Is it through a plugin?
- Locally (all in docker)
