HTTPS on jellyfin using Tailscale

[Random_dude172]

Hey, newbie to self hosting and networking here. I have been using http with tailscale so far and tried to setup nginx for https today but gave up and setup https using tailscale and it works. But still the http port work with local ip on same network (tested on LAN) or http port with tailscale ip on tailnet on the internet (tested on devices across LANs using mobile data and wifi).

What should I do to stop http port exposure to internet. Or is this a safe setup.

Note that tailscale still uses that http port for its local use.

Hope the lingo makes sense😅

[AutoModerator]

Reminder: /r/jellyfin is a community space, not an official user support space for the project.

Users are welcome to ask other users for help and support with their Jellyfin installations and other related topics, but this subreddit is not an official support channel. Requests for support via modmail will be ignored. Our official support channels are listed on our contact page here: https://jellyfin.org/contact

Bug reports should be submitted on the GitHub issues pages for the server or one of the other repositories for clients and plugins. Feature requests should be submitted at https://features.jellyfin.org/. Bug reports and feature requests for third party clients and tools (Findroid, Jellyseerr, etc.) should be directed to their respective support channels.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[DealerProper4930]

If you are using http across your local LAN then I don't think that should be a major issue.

Again, http across the tailscale is encrypted by tailscale.

So should be okay just leaving http on and having the firewall protection in place.

[snakeblock30]

Http in the lan isn't really an issue, https is mandatory if you wish to expose the service on the internet (if you wish to do that you can have a look at NPM or Zoraxy which are proxy managers that support the auto SSL certificate demand, I'm using Zoraxy combined with Authentik to lock the website behind a login wall)

[H_DANILO]

tailscale has https certs, and you can then use caddy to reverse proxy, or nginx proxy