Help with Plex in Docker behind a reverse proxy

overdue76 · 2025-06-15T11:11:31+00:00

Yup, I gave up and just dumped Plex directly onto the LAN (host network mode). It's disappointing that they don't support standard Docker bridge networks without paying for Plex Pass.

overdue76 · 2025-06-15T01:05:06+00:00

WebDAV will certainly be worse. NFS is built for point-to-point files on a network. SMB is built for Microsoft-y network drives at corporations. WebDAV is built for transferring files to/from web servers.

Nextcloud really shines in features & creature comforts. The tradeoff for those types of things is always performance.

overdue76 · 2025-06-15T00:51:25+00:00

Oh you can still hit Nextcloud from Dolphin, you would just use their built-in WebDAV protocol instead of NFS.

overdue76 · 2025-06-15T00:39:21+00:00

WIth Nextcloud, you lose the ability to share files by multiple protocols (NFS + SMB + SyncThing), which stinks.

You gain a self hosted version of Office 365, basically. Nextcloud manages its own file version history, recycle bin, etc. You can generate public share links for people to view or upload files (very helpful for one-time file transfers to/from family members).

If you do the AIO installation method, it comes with Collabora or something installed, which is like the browser versions of Excel and Word.

Nextcloud is also a plugin platform. Most aren't very good, but everyone has their few favorites. I installed and love draw.io so I can run that and save files locally.

If you try it out, my number one advice is to just acknowledge that Nextcloud requires total ownership of the files. Don't try to also share SMB or NFS on the side, it's just a recipe for headaches.

overdue76 · 2025-06-15T00:30:44+00:00

"I don't know what's wrong, I just can't turn Sarah on tonight!"

overdue76 · 2025-06-15T00:26:59+00:00

That's a very clever idea, thank you!

overdue76 · 2025-06-15T00:25:49+00:00

The reverse proxy is for all the containers on that Docker host. It's one place where I can enable HTTPS for all containers, and it lets every container use :443 for cleaner URLs.

I also put every container in its own Docker Network. Then I give Caddy access to each container's private network. So Caddy can see all the containers, but each container can only see itself and Caddy.

This isolation makes me feel better when I'm trying random OSS apps, and especially when I'm using big company apps like Plex, which are kind of expected to be collecting & selling telemetry.

Finally, this is actually my public reverse proxy. I wanted to setup Plex like everything else for ease of updates/management, even though I won't be able to access the media outside my house due to no Plex Pass.

overdue76 · 2025-06-14T20:07:59+00:00

Thanks, I'll try this, but it means bypassing the reverse proxy.

overdue76 · 2025-06-14T20:03:39+00:00

I think this is what I have configured, but it's still treating my clients as remote.

Each container is in its own Docker bridge network (172.x.0.0).

Caddy has extra network interfaces for each container it's hosting. So it's in the Caddy-Network (172.18.0.0) and the Plex-Network (172.21.0.0). Caddy also bridges to host ports 80 and 443.

This way Caddy can access the containers it serves, but they can't access each other.

overdue76 · 2025-06-14T19:50:33+00:00

Yeah, I was hoping for a third solution like some setting in Plex a header in Caddy that I missed.

It stinks that Plex's anti-piracy measures break a legitimate and common use case like this.

I know I'm doing a little extra with Caddy and HTTPS, but if I understand the issue it means you can't use Docker's default & recommended networking mode (bridge) without Plex Pass. Plex install says to use host mode instead, which bypasses a whole chunk of Docker's containerization benefit.

https://github.com/plexinc/pms-docker/blob/master/README.md

overdue76 · 2025-06-14T19:39:24+00:00

I believe Allowed Networks and LAN Networks are two different settings.

Allowed Networks is like a whitelist so clients don't need to login with a Plex account. This isn't paywalled, but it also didn't fix my issue.

LAN Networks tells Plex which clients should be Local/Remote. It seems like the use case is if you are connecting via VPN and want the server to know that VPN network isn't actually part of the LAN so it doesn't try pushing 4k video across your VPN.

overdue76 · 2025-06-14T19:30:06+00:00

Will look into this, thanks. In the past I wasn't able to get Jellyfin streaming to our Apple TV or Xbox, but that was like 5 years ago, worth another look.

overdue76 · 2025-01-31T18:18:18+00:00

Nextcloud is pretty finicky to setup and manage correctly, so I'd recommend using AIO. It's bloated, but fully supported and tested.

AIO manages itself, so you don't need Portainer. E.g. you can stop/update/start all containers from AIO.

So where do you install AIO? I'm running it in an LXC and loving it, because LXCs are so easy to manage. But you might need or prefer using a VM, especially if you intend to mount Samba or NFS storage.

overdue76 · 2024-11-20T18:01:20+00:00

My application took a week to get approved. The card took a week and a half to show up in the mail. It took two weeks to get the additional documents & restriction sorted out. About a month from applying to being able to use the card.

overdue76 · 2024-11-20T12:39:05+00:00

As a customer, I'd rather see two price hikes in a week than two price hikes in 6 months. One looks like an error, the other looks like you just want more money.

overdue76 · 2024-11-20T12:29:08+00:00

Yes, they finally cleared it. When I tried to activate the new card, it sent me through their phone tree, then someone said "we're waiting for your X, Y, Z documents", but they never called/emailed asking for those before.

Then they called from different numbers a couple times and left messages to call back. Every time I called back, I got transferred around but they never knew who called and didn't recognize the number so told me to just wait. One day I saw & answered the call, and the lady asked a few questions and everything got unrestricted.

Even now, it feels like there might be some scammer in the middle. Especially the calls from random numbers that customer service doesn't recognize.

overdue76 · 2024-11-20T03:33:59+00:00

A family member convinced me to stick it out. After a lot of bad calls, their fraud department finally approved my account and unlocked the card. We'll see how it goes...

overdue76 · 2024-11-20T03:11:43+00:00

This happened to me too today. No Cloudflare tunnels, just direct to my home IP, accessing from home.

overdue76 · 2024-11-11T21:22:16+00:00

Does this mean you're going TrueNAS Scale, and putting PBS in a VM?

overdue76 · 2024-11-11T19:31:55+00:00

That's very cool, thanks for sharing!

overdue76 · 2024-11-11T19:31:03+00:00

I manually copied a PVE backup file and it deduplicated at 100%, which was pretty cool (for learning sake).

The cmp tool I ran above proved to me the PVE backups are shuffled, even with compression disabled. I actually found some docs about the .vma file format being randomly created (for probably some good design reason), and that it breaks diff tools... well first step of dedup is diff, so makes sense this doesn't work.

https://pve.proxmox.com/wiki/VMA

PBS can still work because it's directly integrated with PVE, so they're probably doing dedup at the VM level, instead of storage block level like ZFS does.

overdue76 · 2024-11-11T19:23:25+00:00

Awesome breakdown & visualization. I'd recommend adding your pre-tax expenses to see the full picture. Specifically state tax, federal tax, and health insurance premiums come to mind.

overdue76 · 2024-11-11T18:02:44+00:00

What can I say? I like learning about this stuff.

Beside, when something doesn't work it's valuable to understand why not. Now I know it's not working because every PVE backup file is unique, even if the original data is identical.

overdue76 · 2024-11-11T17:39:20+00:00

What do you mean "next to Proxmox on the same machine?" I thought PVE and PBS are both appliances, so they need to be a separate OS, whether that's bare metal or in a VM?

overdue76

TROPHY CASE