To get it outside the LAN, you just need to forward the port it uses in your router. Example 8096 for regular http requests.
I would highly recommend getting at least a reverse proxy with an SSL cert.
You can but it will cause security issues. You will need to buy a domain and setup a SSL proxy with https to proxy traffic in. After than I would lock down you firewall rules and make sure that a compromise can’t escape the isolated environment.
Also make sure you docker container is hardened against excaping as it will improve security when a security hole is discovered in jellyfin
Why not just run your own WireGuard instance? I have a pivpn vm for it and it works great. You could also just put jellyfin behind a TLS terminating reverse proxy.
Sounds like a pain to get non technical family members to use.
If you’re willing to break the non web app you could always put it behind an authenticating proxy (which is what I do for myself outside of VPN, setting up a VPN on a phone is obnoxious and I only look at metadata anyway on my phone)
You are not logged in. However you can subscribe from another Fediverse account, for example Lemmy or Mastodon. To do this, paste the following into the search field of your instance: !selfhosted@lemmy.world
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don’t control.
Rules:
Be civil: we’re here to support and learn from one another. Insults won’t be tolerated. Flame wars are frowned upon.
No spam posting.
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it’s not obvious why your post topic revolves around selfhosting, please include details to make it clear.
Don’t duplicate the full text of your blog or github here. Just post the link for folks to click.
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
To get it outside the LAN, you just need to forward the port it uses in your router. Example 8096 for regular http requests. I would highly recommend getting at least a reverse proxy with an SSL cert.
You can but it will cause security issues. You will need to buy a domain and setup a SSL proxy with https to proxy traffic in. After than I would lock down you firewall rules and make sure that a compromise can’t escape the isolated environment.
Also make sure you docker container is hardened against excaping as it will improve security when a security hole is discovered in jellyfin
Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:
5 acronyms in this thread; the most compressed thread commented on today has 8 acronyms.
[Thread #204 for this sub, first seen 9th Oct 2023, 21:05] [FAQ] [Full list] [Contact] [Source code]
If you are not behind a CGNAT, it should be as easy as opening the necessary ports.
I have a reverse proxy running in ports 80, 443 and can safely access Jellyfin on a subdomain without issues from outside my LAN.
Depends on your definition of safe.
If you do a public port forward and set up basic security and proper SSL its safe from the majority of people.
Stick with the VPN. No point in exposing more services with possible security vulnerabilities.
I love Jellyfin but I would absolutely not make it accessible over the public internet. A VPN is the way to go.
Oof, that’s bad… And lazy
Unfortunately a lot of these issues are architectural issues inherited from Emby
Why “absolutely” not?
Have you seen the link?
Oh, sorry, sorry, sorry, i didn’t think this is a link 😅😅😅
Haha, no problem!
Yeah I’m thinking maybe just have family sign up for tailscale.
Why not just run your own WireGuard instance? I have a pivpn vm for it and it works great. You could also just put jellyfin behind a TLS terminating reverse proxy.
CGNAT is a big reason.
Or headscale, works like a charm
Sounds like a pain to get non technical family members to use. If you’re willing to break the non web app you could always put it behind an authenticating proxy (which is what I do for myself outside of VPN, setting up a VPN on a phone is obnoxious and I only look at metadata anyway on my phone)
Yep, that way you can set ACLs, you they can only access the jellyfin ports + the ports you allow them to.
Also, tailacale DNS.
The fact that tailscale has google/apple/etc logon integration will also help.