I already host multiple services via caddy as my reverse proxy. Jellyfin, I am worried about authentication. How do you secure it?

  • skoell13@feddit.orgEnglish
    1·
    26 days ago

    My setup: Locally (all in docker):

    • JF for managing and local access
    • JF with read only mounted volumes that uses the network of my Wireguard client container
    • Wireguard client opening a tunnel to Wireguard server on VPS ** Ping container regularly doing pings to Wireguard Server so the connection stays up (didn’t manage it otherwise)

    VPS (Oracle Cloud free tier, also everything in docker):

    • Caddy as a reverse proxy with https enabled and geolocking (only certain countries are allowed to connect to)
    • fail2ban to block IPs that try to bruteforce credentials
    • Wireguard server

    Usernames are not shown in the frontend and have to be entered. Passwords are generated by a password manager and can’t be changed by the user.

    So my clients just get the URL of my reverse proxy and can access the read only JF through my Wireguard tunnel. Didn’t have to open any ports on my side. If someone is interested I can share the docker compose files later.

    Edit: Here the link to the setup description. Please tell me if something is not clear or you find an error. https://codeberg.org/skjalli/jellyfin-vps-setup

  • dan@upvote.auEnglish
    1·
    26 days ago

    Is it just you that uses it, or do friends and family use it too?

    The best way to secure it is to use a VPN like Tailscale, which avoids having to expose it to the public internet.

    This is what I do for our security cameras. My wife installed Tailscale on her laptop and phone, created an account, and I added her to my Tailnet. I created a home screen icon for the Blue Iris web UI on her phone and mentioned to her, “if the cameras don’t load, open Tailscale and make sure it’s connected”. Works great - she hasn’t complained about anything at all.

    If you use Tailscale for everything, there’s no need to have a reverse proxy. If you use Unraid, version 7 added the ability to add individual Docker containers to the Tailnet, so each one can have a separate Tailscale IP and subdomain, and thus all of them can run on port 80.

  • Mubelotix@jlai.luEnglish
    0·
    26 days ago

    Jellyfin is secure by default, as long as you have https. Just chose a secure password

    • doeknius_gloek@discuss.tchncs.deEnglish
      1·
      26 days ago

      No, it isn’t.

      EDIT: I quickly want to add that Jellyfin is still great software. Just please don’t expose it to the public web, use a VPN (Wireguard, Tailscale, Nebula, …) instead.

  • jagged_circle@feddit.nlEnglish
    0·
    26 days ago

    Kinda hard because they have an ongoing bug where if you put it behind a reverse proxy with basic auth (typical easy button to secure X web software on Internet), it breaks jellyfin.

    Best thing is to not. Put it on your local net and connect in with a vpn

    • satans_methpipe@lemmy.worldEnglish
      01·
      26 days ago

      I’m not experiencing that bug. My reverse proxy is only accessed locally at the moment though. I did have to play with headers a bit in nginx to get it working.

  • CapitalNumbers@lemm.eeEnglish
    0·
    24 days ago

    So i’ve been trying to set this up this exact thing for the past few weeks - tried all manner of different Nginx/Tailscale/VPS/Traefik/Wireguard/Authelia combos, but to no avail

    I was lost in the maze

    However, I realised that it was literally as simple as setting up a CloudFlare Tunnel on my particular local network I wanted exposed (in my case, the Docker network that runs the JellyFin container) and then linking that domain/ip:port within CloudFlare’s Zero Trust dashboard

    Cloudflare then proxies all requests to your public domain/route to your locally hosted service, all without exposing your private IP, all without exposing any ports on your router, and everything is encrypted with HTTPS by default

    And you can even set up what looks like pretty robust authentication (2FA, limited to only certain emails, etc) for your tunnel

    Not sure what your use case is, but as mine is shared with only me and my partner, this worked like a charm

    • chriscrutch@lemm.eeEnglish
      0·
      23 days ago

      I’m pretty sure that using Jellyfin over Cloudflare tunnels is against their TOS, just FYI. I’m trying to figure out an alternative myself right now because of that.

      • nk@thebrainbin.org
        1·
        3 days ago

        I just moved from that. I now have Traefik on aVPS with a Wireguard server that my home router connects to (Immich IP forwarded in the config of WG).

        • chriscrutch@lemm.eeEnglish
          1·
          3 days ago

          Thanks for mentioning. I ended up using a Tailscale funnel and everything is running swimmingly so far.

    • vodka@lemm.eeEnglish
      0·
      23 days ago

      Pay attention to your email, when cloudflare decides to warn you for this (they will, it’s very very much against TOS) they’ll send you an email, if you don’t remove the tunnel ASAP, your entire account will be terminated.

      • CapitalNumbers@lemm.eeEnglish
        1·
        21 days ago

        Why would Cloudflare warn me against a service they themselves offer? The email authentication is all managed by them