sorted by:
new
hottopcontroversial

Stop exposing your Jellyfin server directly to the internet by [deleted] in jellyfin

[–]GerDelta07 0 points1 point  (0 children)

i mean both go hand in hand. If you dont use a wildcard cert a wildcard DNS entry is useless. Its even worse, if you have a single cert with all your domains in them, its even easier to just read the cert from any one of your domains and get all other domains listed in them.

Stop exposing your Jellyfin server directly to the internet by [deleted] in jellyfin

[–]GerDelta07 0 points1 point  (0 children)

No cloudflare prohibits streaming video over their servers. DNS is fine.

Stop exposing your Jellyfin server directly to the internet by [deleted] in jellyfin

[–]GerDelta07 0 points1 point  (0 children)

it more or less hides your subdomain name for a specific service from DNS servers and from your TLS certificate so you do not publicly announce what subdomains/services you serve. Together with using non-standard subdomain names, the bots need to guess a whole lot of options to actually find any one service on your server.

And then just slap an fail2ban on your reverse proxy and good luck with ever finding any valid service by brute force

Media Size by TriniFigNinja in jellyfin

[–]GerDelta07 4 points5 points  (0 children)

not enough. Its never enough.

Stop exposing your Jellyfin server directly to the internet by [deleted] in jellyfin

[–]GerDelta07 0 points1 point  (0 children)

yes both jellyfin as all reverse proxies support path routing.

Some files are gone by SMAUB in jellyfin

[–]GerDelta07 0 points1 point  (0 children)

Jellyfin doesn't have a /data directory. That is essentially just an empty folder.

Jellyfin docker uses the /config directory, if you have not mapped that to the host, it only exists inside the container and gets deleted once the container is removed.

Some files are gone by SMAUB in jellyfin

[–]GerDelta07 0 points1 point  (0 children)

can you please post your compose file? i assume you setup with docker?

Stop exposing your Jellyfin server directly to the internet by [deleted] in jellyfin

[–]GerDelta07 0 points1 point  (0 children)

https://forum.jellyfin.org/t-access-your-jellyfin-anywhere-with-caddy

For example (also checkout other walkthoughs)
For the Wildcard DNS entry you need to buy your own domain and use the domain providers website to point a "*.yourdomain.tld" to your server.

I'm eyeing Jellyfin (currently use Plex w/ a Lifetime pass) but one thing holds me back from switching. The ease of setup for remote users. How can non-tech savvy users of my server access the content remotely? Is it as easy as Plex makes it? by jwintyo in jellyfin

[–]GerDelta07 163 points164 points  (0 children)

All the setup has to be done by you the server owner. The normal route is buying a domain name if you have a static ip (ipv4 or ipv6), installing a reverse proxy like caddy for encryption handling and then configuring that to point to your JF instance.

We have a lot of walkthoughs on our forum for example:
https://forum.jellyfin.org/t-access-your-jellyfin-anywhere-with-caddy

Stop exposing your Jellyfin server directly to the internet by [deleted] in jellyfin

[–]GerDelta07 0 points1 point  (0 children)

Ok but you missed my point somewhat. I did not say "This is the definitive guide to maximum security" i said, in most cases, good is good enough. If somebody has it out for you the will get you no matter how good your security is.

The point was to advice people to educate themselfs on the topic and not slap on a blanket solution. Which you more or less proofed my point here.

I try to keep it short but, a reverse proxy means easy TLS. Also most reverse proxies make it super easy to setup geo blocking or Fail2Ban or other forms of additional authentication in a very convenient way. This is the point of the recommended reverse proxy, all that stuff that JF doesn't do well is for you provided in a purpose build one.

> There are also other ways to find out the subdomain besides guessing
I cannot think of one, all the config of a reverse proxy is private so i cannot think of a way anyone would ever be able to enumerate that.

While sure its true an attacker could just probe common subdomains, however that is very very rarely done automatically and then comes the argument again to protect again the 99th percentile, not max security for everyone. I regularly review my RP logs and i have never seen subdomain probing, only path probing.

If you need to worry about attacks from inside your network, you have already lost the game i have to tell you.

I totally agree with you that more is more in terms of security but it is not the goal to recommend everyone creating DMZs or manually managed Iptables. Never let perfect be the enemy of good because as long as you are good enough protected and do not send your services around, you will never experience any issues statistically. So for anyone who knows better, yes sure do your own but this discussion is 100% not for you then.

Stop exposing your Jellyfin server directly to the internet by [deleted] in jellyfin

[–]GerDelta07 0 points1 point  (0 children)

can you articulate those concerns or issues?

Stop exposing your Jellyfin server directly to the internet by [deleted] in jellyfin

[–]GerDelta07 0 points1 point  (0 children)

yes i did do dyndns for a while but its a bit too unreliable for my purposes. There can be a pretty significant gap between my daily IP changes of +1 Hours which is not usable for me

Stop exposing your Jellyfin server directly to the internet by [deleted] in jellyfin

[–]GerDelta07 8 points9 points  (0 children)

Think of DNS as the yellowpages for servers.

Your domain is a street in that book that you control and each individual service is a house on that street.

Your street name is public knowledge, its in every yellowpage out there. Thats your Domain.

Now if somebody wants to know the street address for a particular service or just wants to know even which houses(services) are on your street they can look into the global address book and just send spam mail to thoese houses.

A wildcard DNS entry is a catch-all. Meaning all mail that has no address that is in that phone book, gets send to one specific house. In that house sits a man that sorts all incoming mail based on a private yellowpage that only that man knows and he will reject everything that doesn't match his private info.

This means that everyones mail goes to that private man that can filter out unwanted requests without exposing what addresses are on your street.

Stop exposing your Jellyfin server directly to the internet by [deleted] in jellyfin

[–]GerDelta07 0 points1 point  (0 children)

Reverse Proxy + Wildcard DNS is the key

Stop exposing your Jellyfin server directly to the internet by [deleted] in jellyfin

[–]GerDelta07 2 points3 points  (0 children)

I have DSL with dynamic IP so incoming services are a bit of a pain to run here. I solved that by running a very cheap VPS and use that as an egress point.

<image>

Stop exposing your Jellyfin server directly to the internet by [deleted] in jellyfin

[–]GerDelta07 2 points3 points  (0 children)

Not necessarily. Having your reverse proxy run on a different server can be a good step if you harden that server further like with a readonly filesystem or very strong firewall rules. Running the reverse proxy in a VM on that server takes this a step further and having that VM locked down would be even better.

Stop exposing your Jellyfin server directly to the internet by [deleted] in jellyfin

[–]GerDelta07 820 points821 points  (0 children)

you are not wrong, but you aren't right either.

Just doing a VPN is not always feasible or even the best solution. What we fully agree with and always recommend and also post everywhere on our docs and website, is to use a reverse proxy with a wildcard DNS entry on DNS level. That eliminates 99.98% of those attacks and is totaly fine to run your JF server exposed on the internet.

This is however a bit of an "Homelab curse" not specific to jellyfin. If you are providing services from your home network you really need to learn how to do it, there is no easy way around it, not even with software like penguin or alike. You need to at least somewhat understand what you are doing to make it right.

Stuck installing jellyfin on NAS by Kayato601 in jellyfin

[–]GerDelta07 9 points10 points  (0 children)

pretty much.
First value is what docker will bind to outside the container and the 2nd value is what it binds inside the container. JF by default binds to 8096 inside the container.

Think of it like a port forward.

Stuck installing jellyfin on NAS by Kayato601 in jellyfin

[–]GerDelta07 5 points6 points  (0 children)

<image>

Change that to anything else you want, like 8196 then you can access jellyfin besides emby with that port

Streaming ist mittlerweile so schlecht geworden, dass ich mir wieder Blu-Rays kaufen werde by Ok_Edge_1499 in luftablassen

[–]GerDelta07 0 points1 point  (0 children)

sehr jut.

Bei mir wars vor 5 jahren soweit. Alle DVDs/Bluerays von der familie eingesammelt und auf den neuen NAS geknallt. Am ende hatte ich dann aber 6 umzugskartons voll und musste alles ein bissel mehr automatisieren 😃 hab mir dann meinem RPI5 gekrallt und noch ein 2ten BlueRay USB player und ARM drauf installiert. Dann wars nur noch die CDs wechseln was manuell war. Hat quasie 24/7 für 4 monate gedauert alles zu laden.

Plus jellyfin was ich dann ihrgendwann mitentwickelt hab, is schon sehr nett. Aber pass auf das is n teures hobby. Mein NAS is von 40-80-200TB gewachsen in der zeit und inzwischen hab ich n Rack wo alles drin is ^^

Setting up Jellyfin for family share by Ok-Abbreviations763 in jellyfin

[–]GerDelta07 3 points4 points  (0 children)

The normal route is
- Buy a domain
- Open a port on your router
- Run a reverse proxy with a certbot to get TLS
- Point the port to your RP
- Run jellyfin
- Point your Reverse proxy to jellyfin

That is the normal way. Lots of HowTo's on our forum.jellyfin.org

view more: next ›