deddit.petersanchez.com

How to secure Jellyfin hosted over the internet?
from lambda@programming.dev to selfhosted@lemmy.world on 31 Mar 04:36
https://programming.dev/post/27809653

I already host multiple services via caddy as my reverse proxy. Jellyfin, I am worried about authentication. How do you secure it?

#selfhosted

threaded - newest

borax7385@lemmy.world on 31 Mar 04:47 next collapse

I use fail2ban to ban IPs that fall to login and also IPs that perform common scans in the reverse proxy

nullPointer@programming.dev on 31 Mar 06:14 collapse

also have jellyfin disable the account after a number of failed logins.

dan@upvote.au on 31 Mar 05:02 next collapse

Is it just you that uses it, or do friends and family use it too?

The best way to secure it is to use a VPN like Tailscale, which avoids having to expose it to the public internet.

This is what I do for our security cameras. My wife installed Tailscale on her laptop and phone, created an account, and I added her to my Tailnet. I created a home screen icon for the Blue Iris web UI on her phone and mentioned to her, “if the cameras don’t load, open Tailscale and make sure it’s connected”. Works great - she hasn’t complained about anything at all.

If you use Tailscale for everything, there’s no need to have a reverse proxy. If you use Unraid, version 7 added the ability to add individual Docker containers to the Tailnet, so each one can have a separate Tailscale IP and subdomain, and thus all of them can run on port 80.

paequ2@lemmy.today on 31 Mar 05:13 collapse

if the cameras don’t load, open Tailscale and make sure it’s connected

I’ve been using Tailscale for a few months now and this is my only complaint. On Android and macOS, the Tailscale client gets randomly killed. So it’s an extra thing you have to manage.

It’s almost annoying enough to make me want to host my services on the actual internet… almost… but not yet.

Lem453@lemmy.ca on 31 Mar 05:16 next collapse

I use plain wireguard on me phone, always on essentially with no issues. I wonder why tailscale app can’t stay open.

beerclue@lemmy.world on 31 Mar 05:28 next collapse

Same, wireguard with the 'WG Tunnel" app, which adds conditional Auto-Connect. If not on home wifi, connect to the tunnel.

dan@upvote.au on 31 Mar 06:49 next collapse

conditional Auto-Connect. If not on home wifi, connect to the tunnel.

You don’t need this with Tailscale since it uses a separate IP range for the tunnel.

Edit: Tailscale (and Wireguard) are peer-to-peer rather than client-server, so there’s no harm leaving it connected all the time, and hitting the VPN IPs while at home will just go over your local network.

The one thing you probably wouldn’t do at home is use an exit node, unless you want all your traffic to go through another node on the Tailnet.

beerclue@lemmy.world on 31 Mar 11:26 collapse

I also have a different subnet for WG. Not sure I understand what you’re saying…

dan@upvote.au on 31 Mar 17:47 collapse

If you have a separate subnet for it, then why do you only want it to be connected when you’re not on home wifi? You can just leave it connected all the time since it won’t interfere with accessing anything outside that subnet.

One of the main benefits of Wireguard (and Tailscale) is that it’s peer-to-peer rather than client-server. You can use the VPN IPs at home too, and it’ll add barely any overhead.

(leaving it connected is assuming you’re not routing all your traffic through one of the peers)

beerclue@lemmy.world on 31 Mar 18:10 collapse

My network is not publicly accessible. I can only access the internal services while connected to my VPN or when I’m physically at home. I connect to WG to use the local DNS (pihole) or to access the selfhosted stuff. I don’t need to be connected while I’m at home… In a way, I am always using the home DNS.

Maybe I’m misunderstanding what you’re saying…

Lem453@lemmy.ca on 31 Mar 19:52 collapse

He’s saying that while there is no benefit to being connect to WG at home, there is also no downside so many people just stay connected all the time.

dan@upvote.au on 31 Mar 20:23 next collapse

Yeah, this. Plus if you leave it connected, you can use the VPN IPs while at home instead of having to use a different IP when at home vs when out (or deal with split horizon DNS)

beerclue@lemmy.world on 31 Mar 20:28 collapse

Oh, I get that, but it just doesn’t make any sense to me to be physically next to the server, and connect to it via VPN…

dan@upvote.au on 01 Apr 04:37 collapse

My point is that since the VPN uses a different subnet, it’s fine to keep it connected even at home. It’ll only use the VPN if you access the server’s VPN IP, not its regular IP.

In any case, Tailscale and Wireguard are peer-to-peer, so the connection over the VPN is still directly to the server and there’s no real disadvantage of using the VPN IP on your local network.

beerclue@lemmy.world on 01 Apr 09:05 collapse

Right, but I have wireguard on my opnsense. So when I want to reach jellyfin.example.com , if I am at home, it goes phone -> DNS -> proxy -> jellyfin (on the same network). If I am connected to the VPN, it goes from phone -> internet -> opnsense public ip -> wireguard subnet -> local subnet -> DNS -> proxy -> jellyfin. I see some unneeded extra steps here… Am I wrong?

dan@upvote.au on 01 Apr 16:50 collapse

Oh yeah, there’ll be some overhead if you’re running Wireguard on a router. Hitting your router’s public IP won’t go out to the internet though - the router will recognize that it’s its IP.

It’s common to run Wireguard on every computer/phone/tablet/etc where possible rather than just on the router, since this takes advantage of its peer-to-peer nature. For home use, that’s how it was originally designed to be used. Tailscale makes it a lot easier to configure it this way though - it’s a bit of work for vanilla Wireguard. Tailscale does support “subnet routers” if you have any devices that you want to access over the VPN that can’t run Tailscale.

beerclue@lemmy.world on 02 Apr 01:13 collapse

I don’t think I’ve ever encountered what you say… I use WG it to access a network, not a device. I have a few dozen devices, physical and virtual, why should I set up wg on all of them? Tailscale, maybe, it’s a different story, but I prefer to “self host” and not rely on a 3rd party provider. Wireguard was relatively easy to set up too, a few years ago… and in the meantime, if I need to add a new client, it’s a two minute job.

Lem453@lemmy.ca on 31 Mar 07:10 collapse

I just stay connected to wireguard even at home, only downside is the odd time I need to chromecast, it needs to be shut off.

Damage@feddit.it on 31 Mar 09:15 next collapse

Oh shit, you may have just solved my only issue with Symfonium

beerclue@lemmy.world on 31 Mar 11:27 next collapse

I can stay connected, still works, but I don’t think I need the extra hoops.

bonsai@lemmy.dbzer0.com on 31 Mar 16:22 collapse

Can you add a split tunnel for just the Chromecast app (I presume that’s how it works idk I don’t use Chromecast) so that just that specific app always ignores your VPN?

Lem453@lemmy.ca on 31 Mar 19:49 collapse

I haven’t tried it, but the app has the ability to select which app it tunnels.

When you make a new tunnel, it says “all applications” if you click on that you can select specific ones to include or exclude

paequ2@lemmy.today on 31 Mar 05:29 collapse

I suspect that it goes down and stays down whenever there is an app update, but I haven’t confirmed it yet.

Does the plain wireguard app stay up during updates?

Lem453@lemmy.ca on 31 Mar 07:16 collapse

Android wireguard all hasn’t been updated in 18mo. Its extremely simple with a small code base. There basically isn’t anything to update. It uses wireguard kernel module which is itself is only like 700 lines of code. It so simple that it basically became stable very quickly and there is nothing left of update right now.

git.zx2c4.com/wireguard-android/about/

I personally get the from obtainium to bypass play store

[deleted] on 31 Mar 06:21 next collapse

dan@upvote.au on 31 Mar 06:48 next collapse

Yeah my wife and I are both on Android, and I haven’t been able to figure out why it does that.

The Android client is open-source so maybe someone could figure it out. github.com/tailscale/tailscale-android

ladfrombrad@lemdro.id on 31 Mar 08:00 collapse

It loses its foreground notification I’ve found that kills it for me

<img alt="" src="https://lemdro.id/pictrs/image/d3a97b8e-6c18-436a-82a6-254f3a2c71e9.jpeg"> even thou the Quick Toggle and the app itself, shows as running

If I disconnect/reconnect the notification comes back, and I’ve found something even more weird on my device (A Xiaomi with its infamous OOM / background app killer…) is Tailscale still actually works fine most of the time without the foreground notification. I’m hazarding a 70% of the time for me?

A lot of us a while back found v1.5.2 fugged around with the persistent notification going RIP

github.com/tailscale/tailscale/issues/10104

LiveLM@lemmy.zip on 31 Mar 09:45 next collapse

Oh the Quick Toggle has never, ever worked correctly. I hoped they fixed it after the UI refresh update but unfortunately not yet.

ladfrombrad@lemdro.id on 31 Mar 09:55 collapse

What device/ROM are you using?

It’s been very iffy for me on and off from Miui > HyperHyperOS, but just checking now?

Works fine

Like I say, the foreground notification seemed to be the lifeline to some of us using it and keeping it alive, even after IIRC some more restrictions came in with future versions of Android (forgive me, I’m very lazy these days and just skim Mishaal’s TG feed 😇)?

e: also <img alt="dupe" src="https://lemdro.id/pictrs/image/5c7bda63-02fa-447e-88e2-058dd2a41f80.jpeg"> comment ;)

LiveLM@lemmy.zip on 31 Mar 09:56 collapse

For me it’s always been busted both on AOSP and Miui/HyperOS…

ladfrombrad@lemdro.id on 31 Mar 10:08 next collapse

Huh. The nearest I have to an actual “AOSP” device is my King Kong Cubot phone that has probably the cleanest version of “stock Android” I’ve ever seen, and I’m going to presume you mean like a Google Pixel / Graphene etc?

Tailscale and the QS tile / notification was solid on that Cubot but to be honest, I’ve barely turned it on these days and is now one of those drawer phones.

Miui / HyperHyperOS though is a different kettle of fish and exempting Tailscale from its App lel Killer does seem to work. 70-80%ish…

But there is something that just fuggs up and turn it off/on like most thingys I own 🙈

dai@lemmy.world on 31 Mar 13:44 collapse

Works great and has been for some time on my P7P.

Ensure you’ve allowed background usage and turn off manage app if unused.

Keep the notification on and allow notifications.

[deleted] on 31 Mar 09:45 next collapse

LiveLM@lemmy.zip on 31 Mar 09:49 collapse

Oh the Quick Toggle has never, ever worked correctly. I hoped they fixed it after the UI refresh update but unfortunately not yet.

loutr@sh.itjust.works on 31 Mar 09:34 next collapse

Look up your phone on dontkillmyapp.com and make sure tailscale is excluded from battery and network “optimization”.

kalkhas@lemmy.ml on 31 Mar 09:34 next collapse

Have you tried disabling battery optimization for tailscale?

dan@upvote.au on 31 Mar 17:56 collapse

I did this and it still seems to randomly disconnect.

0x0@programming.dev on 31 Mar 09:40 next collapse

Maybe headscale will do better?

dan@upvote.au on 31 Mar 17:58 collapse

Headscale is a replacement for the coordination servers, which are only used to distribute configs and help nodes find each other. It won’t change client-side behaviour.

Byter@lemmy.one on 31 Mar 14:05 collapse

If you make Tailscale your VPN in Android it will never be killed. Mileage may vary depending on flavor of Android. I’ve used this on stock Pixel and GrapheneOS.

Under Settings > Network and internet > VPN

Tap the Cog icon next to Tailscale and select Always-on VPN.

paequ2@lemmy.today on 31 Mar 19:06 collapse

Holy moly, I did not know this existed! Thanks! Just turned this on!

ocean@lemmy.selfhostcat.com on 31 Mar 05:19 next collapse

You could put authentik in front of it too

exu@feditown.com on 31 Mar 05:44 collapse

I think that breaks most clients

Svinhufvud@sopuli.xyz on 31 Mar 07:08 next collapse

Yes, it breaks native login, but you can authenticate with Authentik on your phone for example, and use Quick connect to authorize non-browser sessions with it.

ocean@lemmy.selfhostcat.com on 31 Mar 12:04 collapse

? How does putting something before it break it? It most certainly doesn’t.

lambda@programming.dev on 31 Mar 12:34 collapse

Clients are built to speak directly to the Jellyfin API. if you put an auth service in front it won’t even ask you to try and authenticate with that.

ocean@lemmy.selfhostcat.com on 31 Mar 15:47 collapse

Sorry, when out of the house I only use web not clients.

sludge@lemmy.ml on 31 Mar 05:38 next collapse

I use Pangolin (github.com/fosrl/pangolin)

doeknius_gloek@discuss.tchncs.de on 31 Mar 11:09 next collapse

Uhh, interesting! Thanks for sharing.

jagged_circle@feddit.nl on 31 Mar 16:07 next collapse

URL is 404

sludge@lemmy.ml on 31 Mar 20:34 next collapse

It’s not, though?

ThetaDev@lemm.ee on 31 Mar 20:40 collapse

remove the brace at the end

darkknight@discuss.online on 01 Apr 00:40 collapse

I was thinking of setting this up recntly after seeing it on Jim’s garage. Do you use it for all your external services or just jellyfin? How does it compare to a fairly robust WAF like bunkerweb?

sludge@lemmy.ml on 01 Apr 04:00 collapse

I use it for all of my external services. It’s just wireguard and traefik under the hood. I have no familiarity with bunkerweb, but pangolin integrates with crowdsec. Specifically it comes out of the box with traefik bouncer, but it is relatively straightforward to add the crowdsec firewall bouncer on the host machine which I have found to be adequate for my needs.

softcat@lemmy.ca on 31 Mar 05:45 next collapse

CloudFlare tunnel with Zero Trust, plus their bot and abuse blocking. Users can get in with the right oauth, plus only allowed from the countries I know they’re in. Then just their username and password on jellyfin.

Dhs92@programming.dev on 31 Mar 07:15 next collapse

Doesn’t streaming media over a cloudflare tunnel/proxy violate their ToS

guy@piefed.social on 31 Mar 07:23 next collapse

🤫

Dave@lemmy.nz on 31 Mar 07:55 next collapse

No, they removed that clause some 2 or 3 years back.

softcat@lemmy.ca on 31 Mar 14:39 collapse

They prohibit large amounts of media being streamed, and they reserve the right to suspend or terminate accounts for it. Multiple years in, that has not happened.

Edit: here, you can read blog.cloudflare.com/updated-tos/

merthyr1831@lemmy.ml on 31 Mar 15:34 collapse

Cloudflare is known for being unreliable with how and when it enforces the ToS (especially for paying customers!). Just because they haven’t cracked down on everyone doesn’t mean they won’t arbitrarily pick out your account from thousands of others just to slap a ban on. There’s inherent risk to it

ftbd@feddit.org on 31 Mar 07:36 next collapse

I hate the cloudflare stuff making me do captchas or outright denying me with a burning passion. My fault for committing the heinous crime of using a VPN!

softcat@lemmy.ca on 31 Mar 14:30 collapse

Skill issue

Netrunner@programming.dev on 31 Mar 11:04 next collapse

Using cloudflare tunnels means nothing is encrypted and cloudflare sees all.

softcat@lemmy.ca on 31 Mar 14:39 collapse

Oh no they’ll see I’m watching TNG

rice@lemmy.org on 31 Mar 13:07 collapse

just run wireguard on the jelly server…

softcat@lemmy.ca on 31 Mar 14:41 next collapse

My users aren’t going to figure that out.

rice@lemmy.org on 31 Mar 14:58 collapse

they don’t have to figure it out, you are the one running it

softcat@lemmy.ca on 31 Mar 15:01 collapse

They’d have to connect to it, and possibly reconnect. That aspect is the issue.

jagged_circle@feddit.nl on 31 Mar 16:12 collapse

Can’t use double VPN on mobile.

LainTrain@lemmy.dbzer0.com on 31 Mar 06:25 next collapse

OpenVPN

Evil_Shrubbery@lemm.ee on 31 Mar 08:37 collapse

Or wireguard, depending where & how they want to implement it might be simpler or better/worse on hardware.

Mubelotix@jlai.lu on 31 Mar 07:43 next collapse

~~Jellyfin is secure by default, as long as you have https. Just chose a secure password~~

doeknius_gloek@discuss.tchncs.de on 31 Mar 08:46 collapse

No, it isn’t.

EDIT: I quickly want to add that Jellyfin is still great software. Just please don’t expose it to the public web, use a VPN (Wireguard, Tailscale, Nebula, …) instead.

Mubelotix@jlai.lu on 31 Mar 08:49 next collapse

Wtf. Thank you

Flipper@feddit.org on 31 Mar 09:22 next collapse

Some of these are bonkers. The argument not to fix them because of backwards compatibility is even wilder. Which normal client would need the ability to get data for any other account that it hasn’t the Auth token for.

sugar_in_your_tea@sh.itjust.works on 31 Mar 14:38 collapse

Just make a different API prefix that’s secure and subject to change, and once the official clients are updated, deprecate the insecure API (off by default).

That way you preserve backwards compatibility without forcing everyone to be insecure.

merthyr1831@lemmy.ml on 31 Mar 15:31 collapse

Even just basic API versioning would be sufficient. .NET offers a bunch of ways to handle breaking changes in APIs

LiveLM@lemmy.zip on 31 Mar 09:51 next collapse

Oh boy. Nope. My friends gonna have to fiddle with a VPN, forget exposing JF to the outside…

rice@lemmy.org on 31 Mar 13:07 collapse

wireguard honestly takes like 30 seconds to do once you learn how to use it.

rice@lemmy.org on 31 Mar 13:06 collapse

I wouldn’t say “great” it’s ok software. Not even due to all of those security things which is a nightmare too. They do things like break the search speed months ago and not have any idea why, it’s so insanely slow and on top of that it somehow lags the entire client when searching too, not just the server which is the only thing doing the query. Lots of issues just with that.

skoell13@feddit.org on 31 Mar 08:02 next collapse

My setup: Locally (all in docker):

JF for managing and local access
JF with read only mounted volumes that uses the network of my Wireguard client container
Wireguard client opening a tunnel to Wireguard server on VPS ** Ping container regularly doing pings to Wireguard Server so the connection stays up (didn’t manage it otherwise)

VPS (Oracle Cloud free tier, also everything in docker):

Caddy as a reverse proxy with https enabled and geolocking (only certain countries are allowed to connect to)
fail2ban to block IPs that try to bruteforce credentials
Wireguard server

Usernames are not shown in the frontend and have to be entered. Passwords are generated by a password manager and can’t be changed by the user.

So my clients just get the URL of my reverse proxy and can access the read only JF through my Wireguard tunnel. Didn’t have to open any ports on my side. If someone is interested I can share the docker compose files later.

Edit: Here the link to the setup description. Please tell me if something is not clear or you find an error. codeberg.org/skjalli/jellyfin-vps-setup

CarlosSpicyWiener@lemmy.world on 31 Mar 08:24 next collapse

I am interested in your docker compose

skoell13@feddit.org on 31 Mar 09:23 next collapse

Will share this evening after work.

skoell13@feddit.org on 31 Mar 20:12 collapse

codeberg.org/skjalli/jellyfin-vps-setup here you go, took me longer than expected and I hope it’s helpful, might contain a few errors since I had to remove some settings but I guess this should work.

shaserlark@sh.itjust.works on 01 Apr 21:25 collapse

This is honestly awesome! I was thinking about a similar setup for a long time but wasn’t sure how to do this exactly, this seems exactly like the setup I was looking for. Thank you!

skoell13@feddit.org on 01 Apr 22:01 collapse

You’re welcome, happy that I can help. I also just updated it a bit. In case you find any issues or have questions please let me know. It was mostly trial and error until it ran…

lambda@programming.dev on 31 Mar 14:27 next collapse

I’m more interested in the fail2ban setup. How did you do that for Jellyfin? Is it through a plugin?

skoell13@feddit.org on 31 Mar 16:39 collapse

It’s a separate container, currently in the process of writing everything up, will update once done

lambda@programming.dev on 31 Mar 17:50 collapse

Thanks!

skoell13@feddit.org on 31 Mar 20:12 collapse

lambda@programming.dev on 31 Mar 20:44 collapse

Thanks! I’ll read more through it when I have the chance!

Enceladus@lemmy.ca on 31 Mar 15:14 collapse

This seems like a developer/infrastructure level job, any dumb down step by step procedure to recommend?

skoell13@feddit.org on 31 Mar 16:39 next collapse

I am currently in the ptocess to document my docker fioes and upload them to codeberg with a readme, it takes a bit, will let you know once I am done

skoell13@feddit.org on 31 Mar 20:12 collapse

Enceladus@lemmy.ca on 31 Mar 20:16 collapse

Thank you! Impressive documentation work, looks like I have to learn docker first.

skoell13@feddit.org on 31 Mar 21:05 collapse

It’s a steep learning curve for sure but once you get the basics it’s straight forward until you hit very specific problems.

Are you a Windows or Linux user? They often want to push their Docker UI application but in my opinion docker engine with docker compose is enough. There are probably a lot of great tutorials out there and I can recommend www.linuxserver.io for images.

Rookeh@startrek.website on 31 Mar 10:23 next collapse

For web access, stick it behind a reverse proxy and use something like Authentik/Authelia/SSO provider of your choice to secure it.

For full access including native clients, set up a VPN.

lambda@programming.dev on 31 Mar 14:25 collapse

I use Tailscale right now. Which, in fairness, I didn’t state in the post. However, I was hoping to share it more similarly to how I used to with Plex. But, it would appear, I would have to share it through Tailscale only at this point.

Rookeh@startrek.website on 01 Apr 12:56 collapse

Right now none of the native clients support SSO. It is a frequently requested feature but, unfortunately, it doesn’t look like it will be implemented any time soon. As with many OSS projects it is probably a case of “you want it, you build it” - but nobody has actually stepped up.

geography082@lemm.ee on 31 Mar 11:07 next collapse

My setup is: Proxmox - restricted LXC running docker which runs jellyfin, tailscale funnel as reverse proxy and certificate provider. So so don’t care about jellyfin security, it can get hacked / broken , its an end road. If so i will delete the LXC and bring it up again using backups. Also i dont think someone will risk or use time to hack a jellyfin server. My strategy is, with webservices that don’t have critical personal data, i have them isolated in instances. I don’t rely on security on anything besides the firewall. And i try not to have services with personal sensitive data, and if i do, on my local lan with the needed protections. If i need access to it outside my local lan, vpn.

SplashJackson@lemmy.ca on 31 Mar 12:42 next collapse

Mostly via empty threats, but occaisonally I have had to whip out the soccer ball

drmoose@lemmy.world on 31 Mar 15:20 next collapse

Tailscale is awesome. Alternatively if you’re more technically inclined you can make your own wireguard tailscale and all you need is to get a static IP for your home network. Wireguard will always be safer than each individual service.

irmadlad@lemmy.world on 31 Mar 16:58 next collapse

Love tailscale. The only issue I had with it is making it play nice with my local, daily driver VPN. Got it worked out tho. So, now everything is jippity jippity.

SpaceCadet@feddit.nl on 01 Apr 09:08 collapse

all you need is to get a static IP for your home network

Don’t even need a static IP. Dyndns is enough.

quant@leminal.space on 01 Apr 09:30 collapse

Unless you’re behind cgnat and without ipv6 support.

SpaceCadet@feddit.nl on 01 Apr 09:46 collapse

cgnat

jagged_circle@feddit.nl on 31 Mar 16:03 next collapse

Kinda hard because they have an ongoing bug where if you put it behind a reverse proxy with basic auth (typical easy button to secure X web software on Internet), it breaks jellyfin.

Best thing is to not. Put it on your local net and connect in with a vpn

satans_methpipe@lemmy.world on 31 Mar 17:12 collapse

I’m not experiencing that bug. My reverse proxy is only accessed locally at the moment though. I did have to play with headers a bit in nginx to get it working.

jagged_circle@feddit.nl on 31 Mar 17:38 collapse

Basic auth. The bug is if you enable basic auth.

satans_methpipe@lemmy.world on 31 Mar 17:42 collapse

It is enabled, but now I’m doubting that. I’ll double check when my homelab shift is complete.

jagged_circle@feddit.nl on 01 Apr 06:21 collapse

It isnt. Else you wouldn’t be able to load many jellyfin assets. Because there’s a colission of the Auth header

jagged_circle@feddit.nl on 31 Mar 16:14 next collapse

I have another site on a different port that sits behind basic auth and adds the IP to a short ipset whitelist.

So first I have to auth into that site with basic auth, then I load jellyfin on the other port.

Overboard8171@startrek.website on 31 Mar 19:16 collapse

I don’t understand how that isn’t widely deployed. I call it poor man’s Zero Trust.

jagged_circle@feddit.nl on 01 Apr 06:20 collapse

I mean I’d rather jellyfin fix the bug and let me just put that behind basic auth

KingThrillgore@lemmy.ml on 31 Mar 21:35 next collapse

Use a VPN like Tailscale

[deleted] on 31 Mar 22:52 next collapse

Batman@lemmy.world on 01 Apr 00:51 next collapse

I am using tailscale but I went a little further to let my family log in with their Gmail( they will not make any account for 1 million dollars)

Tailscale funneled Jellyfin Keycloak (adminless)

Private Tailscale Keycloak admin Postgres dB

I hook up jellyfin to Keycloak (adminless) using the sso plugin. And hook Keycloak up (using the private instance) to use Google as an identity provider with a private app.

lambda@programming.dev on 01 Apr 12:59 collapse

SSO plugin is good to know about. Does that address any of the issues with security that someone was previously talking about?

Batman@lemmy.world on 01 Apr 21:37 collapse

I’d say it’s nearly as secure as

basic authentication. If you restrict deletion to admin users and use role (or group) based auth to restrict that jellyfin admin ability to people with strong passwords in keycloak, i think you are good. Still the only risk is people could delete your media if an adminusers gmail is hacked.

Will say it’s not as secure as restricting access to vpn, you could be brute forced. Frankly it would be preferable to set up rate limiting, but that was a bridge too far for me

Appoxo@lemmy.dbzer0.com on 02 Apr 05:39 collapse

I set mine up with Authelia 2FA and restricted media deletion to one user: The administrator.
All others arent allowed to delete. Not even me.

gagootron@feddit.org on 01 Apr 04:53 next collapse

I use good ol’ obscurity. My reverse proxy requires that the correct subdomain is used to access any service that I host and my domain has a wildcard entry. So if you access asdf.example.com you get an error, the same for directly accessing my ip, but going to jellyfin.example.com works. And since i don’t post my valid urls anywhere no web-scraper can find them. This filters out 99% of bots and the rest are handled using authelia and crowdsec

sludge@lemmy.ml on 01 Apr 06:47 next collapse

And since i don’t post my valid urls anywhere no web-scraper can find them

You would ah… be surprised. My urls aren’t published anywhere and I currently have 4 active decisions and over 300 alerts from crowdsec.

It’s true none of those threat actors know my valid subdomains, but that doesn’t mean they don’t know I’m there.

gagootron@feddit.org on 01 Apr 07:17 collapse

Of course i get a bunch of scanners hitting ports 80 and 443. But if they don’t use the correct domain they all end up on an Nginx server hosting a static error page. Not much they can do there

SpaceCadet@feddit.nl on 01 Apr 09:11 collapse

This is how I found out Google harvests the URLs I visit through Chrome.

Got google bots trying to crawl deep links into a domain that I hadn’t published anywhere.

zod000@lemmy.ml on 01 Apr 14:42 collapse

This is true, and is why I annoyingly have to keep robots.txt on my unpublished domains. Google does honor them for the most part, for now.

SpaceCadet@feddit.nl on 01 Apr 17:41 collapse

That reminds me … another annoying thing Google did was list my private jellyfin instance as a “deceptive site”, after it had uninvitedly crawled it.

A common issue it seems.

Nibodhika@lemmy.world on 02 Apr 06:23 next collapse

They did that with most of my subdomains

zod000@lemmy.ml on 02 Apr 13:17 collapse

Unsurprising, but still shitty. Par for the course for the company these days.

andreluis034@bookwormstory.social on 01 Apr 09:01 next collapse

Are you using HTTPS? It’s highly likely that your domains/certificates are being logged for certificate transparency. Unless you’re using wildcard domains, it’s very easy to enumerate your sub-domains.

ocean@lemmy.selfhostcat.com on 01 Apr 21:45 next collapse

That’s not how web scrappers work lol. No such thing as obscurity except for humans

gagootron@feddit.org on 02 Apr 04:14 collapse

It seems to that it works. I don’t get any web-scrapers hitting anything but my main domain. I can’t find any of my subdomains on google.

Please tell me how you believe that it works. Maybe i overlooked something…

ocean@lemmy.selfhostcat.com on 02 Apr 13:53 collapse

My understanding is that scrappers check every domain and subdomain. You’re making it harder but not impossible. Everything gets scrapped

It would be better if you also did IP whitelisting, rate limiting to prevent bots, bot detection via cloudflare or something similar, etc.

Nibodhika@lemmy.world on 02 Apr 06:36 collapse

If you’re using jellyfin as the url, that’s an easily guessable name, however if you use random words not related to what’s being hosted chances are less, e.g. salmon.example.com . Also ideally your server should reply with a 200 to * subdomains so scrappers can’t tell valid from invalid domains. Also also, ideally it also sends some random data on each of those so they don’t look exactly the same. But that’s approaching paranoid levels of security.

Kusimulkku@lemm.ee on 01 Apr 08:45 next collapse

I’ve put it behind WireGuard since only my wife and I use it. Otherwise I’d just use Caddy or other such reverse proxy that does https and then keep Jellyfin and Caddy up to date.

SpaceCadet@feddit.nl on 01 Apr 09:21 next collapse

What I used to do was: I put jellyfin behind an nginx reverse proxy, on a separate vhost (so on a unique domain). Then I added basic authentication (a htpasswd file) with an unguessable password on the whole domain. Then I added geoip firewall rules so that port 443 was only reachable from the country I was in. I live in small country, so this significantly limits exposure.

Downside of this approach: basic auth is annoying. The jellyfin client doesn’t like it … so I had to use a browser to stream.

Nowadays, I put all my services behind a wireguard VPN and I expose nothing else. Only issue I’ve had is when I was on vacation in a bnb and they used the same IP range as my home network :-|

fennec@lemm.ee on 01 Apr 09:40 next collapse

Whats your setup? I just Ngnix Proxy Manager, Jellyfin etc in Docker. Modify ufw rules and also install this on the server (linux) github.com/friendly-bits/geoip-shell

GreenKnight23@lemmy.world on 01 Apr 15:14 next collapse

setup a WAF appliance and forward traffic through it to your current installation.

lambda@programming.dev on 02 Apr 13:05 collapse

WAF??

GreenKnight23@lemmy.world on 02 Apr 14:19 collapse

web application firewall.

think of it like an intelligent firewall proxy that can take action against perceived threats like injection attacks or timed attacks. some can also help fight against DDOS when integrated with an actual firewall upstream.

Hawk@lemmynsfw.com on 02 Apr 04:40 next collapse

Wireguard (or tailscale) would be best here.

CapitalNumbers@lemm.ee on 02 Apr 22:14 collapse

So i’ve been trying to set this up this exact thing for the past few weeks - tried all manner of different Nginx/Tailscale/VPS/Traefik/Wireguard/Authelia combos, but to no avail

I was lost in the maze

However, I realised that it was literally as simple as setting up a CloudFlare Tunnel on my particular local network I wanted exposed (in my case, the Docker network that runs the JellyFin container) and then linking that domain/ip:port within CloudFlare’s Zero Trust dashboard

Cloudflare then proxies all requests to your public domain/route to your locally hosted service, all without exposing your private IP, all without exposing any ports on your router, and everything is encrypted with HTTPS by default

And you can even set up what looks like pretty robust authentication (2FA, limited to only certain emails, etc) for your tunnel

Not sure what your use case is, but as mine is shared with only me and my partner, this worked like a charm

chriscrutch@lemm.ee on 03 Apr 02:38 collapse

I’m pretty sure that using Jellyfin over Cloudflare tunnels is against their TOS, just FYI. I’m trying to figure out an alternative myself right now because of that.