Proper way of sharing Jellyfin reddit / selfhosted ---------------------------------------------------------------------- Tisoyyy1 · 2023-10-05 08:17 Hi, it's my first post here and I'm also fairly new to self hosting and the question I have is how do I properly share Jellyfin to my friends without giving my public IP. For context, I have port 9000 opened on my router and I can access Jellyfin from outside my network by typing in \*publicIP\*:9000. But is there a better of doing this, what I have in mind is setting up a reverse proxy using nginx and probably getting my own custom domain so I can access Jellyfin from there but I'm confused if that is the preferred way of doing it. I'd love to here your thoughts, thank you. ---------------------------------------------------------------------- thekrautboy · 2023-10-05 08:23 You could simply use a dynamic DNS provider like Duckdns.org or DeSEC.io to automatically update a simple domain like example.duckdns.org with your (probably dynamic) public IP. As a result, people wouldnt need to remember and type your IP:port but instead just domain:port to connect to your Jellyfin. Wether you use a free domain or a paid one doesnt make a technical difference as long as the provider gives you the required access. If that is not enough then yes, look into using a reverse proxy in front of Jellyfin. Traefik, Nginx, Caddy, etc... tons of tutorials about this already exist and you can also search this sub for existing discussions about it. ---------------------------------------------------------------------- fosterreichert · 2023-10-05 09:17 Cloudflare Tunnels are the way to go. No external facing ports or connections, everything is tunneled through cloudflare directly to the IP:port you set. I have been using it for Jellyfin and *arr containers for months, and have had no issues at all. [https://www.cloudflare.com/products/tunnel/](https://www.cloudflare.c om/products/tunnel/) ---------------------------------------------------------------------- Tisoyyy1 · 2023-10-05 09:19 Thanks so much, I'm also looking into duckdns but looking for other options. ---------------------------------------------------------------------- Tisoyyy1 · 2023-10-05 09:21 Thanks, but I've read about from other similar posts about probably getting banned on cloudfare, but if it works fine for you then I'll give it a try. ---------------------------------------------------------------------- GolemancerVekk · 2023-10-05 09:22 To hide your public IP you need to use a tunnel provider like Cloudflare or Tailscale. [See the 2nd half of this comment](https://ww w.reddit.com/r/selfhosted/comments/16xu5nx/how_do_i_get_to_use_subdoma in_as_server_address/k35rdvi/) for details. If you use a domain mapped to your public IP and use a reverse proxy with TLS it will secure access, but it will expose your IP. Up to you how important hiding your IP is, if you can explain your reason we can weigh in. There are other ways of adding extra security to your Jellyfin access but they usually come with both pros and cons. [This documentation section](https://github.com/zuavra/nginx-ip-whitelister/#12-there-are- better-ways-to-secure-your-server) goes through some of them and how they affect Jellyfin features (like casting to media devices or being able to use 3rd party Jellyfin clients). So why would you want extra security? Two reasons: (1) restricting access to *just* your friends (using a tunnel/reverse proxy still means your server is accessible to the whole internet), and (2) adding an extra layer in case there's a vulnerability in Jellyfin that lets people break in. Please ask if you have any questions, I also run Jellyfin and can probably answer. ---------------------------------------------------------------------- fosterreichert · 2023-10-05 09:22 From my understanding, running it through Cloudflare's DNS proxy is 100% against their TOS. I haven't seen much about running through one of their Access Tunnels, and they haven't said anything yet! ---------------------------------------------------------------------- Tisoyyy1 · 2023-10-05 09:24 Ah! I never knew there was a difference, thanks I'll try it out. ---------------------------------------------------------------------- GolemancerVekk · 2023-10-05 09:43 If you go this route keep in mind it doesn't have to be a dynamic DNS provider; many regular DNS providers have an API nowadays which you can use to update the IP. If the provider has been around for a while there's probably support for their API built into most DDNS tools, like the ones available on OpenWRT routers. You can also run a DDNS tool on your machine, or write your own script that accomplishes the same (or you can find them around if you can't write it). ---------------------------------------------------------------------- GolemancerVekk · 2023-10-05 09:47 Something to keep in mind is that just using a Cloudflare tunnel doesn't technically secure Jellyfin, it just secures the *connection* against eavesdropping (and hides the real IP). You're still relying on Jellyfin login as the main security method. ---------------------------------------------------------------------- thekrautboy · 2023-10-05 09:47 Just to mention tho, not selfhosted. ---------------------------------------------------------------------- lucassou · 2023-10-05 10:42 No they are not. Since it's against their TOS to use their tunnels for streaming I would not advice this. Maybe now they don't care, or you just went under the radar but nothing stops them from suddenly enforcing their TOS and banning accounts. ---------------------------------------------------------------------- lucassou · 2023-10-05 10:45 Well, you can enforce authentication with cloudfllare before being allowed to access the service. (Only allowing approved email and forcing user to enter code sent to their mailbox) ---------------------------------------------------------------------- Arcau1 · 2023-10-05 11:15 Might be unhelpful - I use Emby personally - but does Jellyfin not have a web proxy built in like Emby? [app.emby.media](https://app.emby.media) \- and then the users can login with their accounts that have been added to your server??? ​ If that is not the case - sorry for my ignorance - but you can also then as you suggested use something like NPM to set up - just don't use cloudflare proxy with the A record and you should be fine. ---------------------------------------------------------------------- selfh-sted · 2023-10-05 11:46 If you attempt this, try disabling caching for your Jellyfin subdomain within the Cloudflare settings. The general (yet unconfirmed) consensus has always been that they're much less likely to care as long as you're not forcing them to cache your media as people stream it. ---------------------------------------------------------------------- bozodev · 2023-10-05 12:42 Nginx reverse proxy is the way to go. I have a RPI 4 that I use for the proxy. I have it setup with fail2ban to help mitigate some of the risks of exposing ports. I have a domain that I point to my public IP and then I have ports 80 and 443 pointed to the RPI with nginx. That then routes traffic to Jellyfin. ---------------------------------------------------------------------- Staltrad · 2023-10-05 13:00 ZeroTier/TailScale Don’t open shit in your router ---------------------------------------------------------------------- Green-War-6314 · 2023-10-05 14:02 T ---------------------------------------------------------------------- zachfive87 · 2023-10-05 15:13 Here is a [link](https://forum.jellyfin.org/t-access-your-jellyfin- anywhere-with-caddy) to the jellyfin forum thread about using caddy. I use duckdns, so I created a domain there. Then, [I use this to update my duckdns domain](https://github.com/XWolfOverride/DuckDNS/rel eases/download/2.2b/DuckDNS.7z) Then setting up caddy is dead simple, my caddyfile looks something like myduckdnsdomain.duckdns.org reverse_proxy 127.0.0.1:8096 ---------------------------------------------------------------------- tankerkiller125real · 2023-10-05 15:43 Do not use a Cloudflare tunnel for media content, it's against their ToS and they can terminate your account for it. ---------------------------------------------------------------------- water_we_wading_for · 2023-10-05 16:35 Hi, why wouldn’t you use a ddns provider? Is that just a matter of cost savings? ---------------------------------------------------------------------- 010010000111000 · 2023-10-05 17:25 I used to have some of my services exposed over the internet. I ended up moving everything behind a wire guard VPN as I am not confident in the security of open source software. For anyone who needs access I give them VPN access to my network and then limit what they can access. You can do this on the firewall. If you want to block their access from specific web pages you can use a reverse proxy and create rules there too. ---------------------------------------------------------------------- GolemancerVekk · 2023-10-05 18:32 It's just that so many DNS providers and even registrars offer an API nowadays that it could already be included in services you pay for. If you have a domain check with your registrar. But if you don't have your own domain then yeah, a DDNS service is still useful. ---------------------------------------------------------------------- GolemancerVekk · 2023-10-05 18:39 > I ended up moving everything behind a wire guard VPN as I am not confident in the security of open source software. But WireGuard is open source too. 🙂 ---------------------------------------------------------------------- _avee_ · 2023-10-05 19:20 Not it’s not. They removed that section of ToS not too long ago. ---------------------------------------------------------------------- _avee_ · 2023-10-05 19:24 It is NOT against their ToS to use tunnels for streaming: https://blog.cloudflare.com/updated-tos/ ---------------------------------------------------------------------- readit-on-reddit · 2023-10-05 19:34 1. You can do that without CF tunnels with reverse proxies. You can also add Authentik if you are serious about security. 2. This breaks all apps. When you use the mobile or TV apps you need to add the server address and enter your credentials. So it's essentially useless unless you only use the browser to watch videos. ---------------------------------------------------------------------- tankerkiller125real · 2023-10-05 19:44 Tunnels have to use the CDN in order to get routed correctly (in my experience) which means that your still violating the terms. Notably if you fully read that article it says: Finally, we made it clear that customers can serve video and other large files using the CDN **so long as that content is hosted by a Cloudflare service like Stream, Images, or R2**. ---------------------------------------------------------------------- _avee_ · 2023-10-05 19:52 It’s not very clear whether tunnels count as using CDN… In the examples they show a customer using their Zero Trust services (which do include tunnels) and CDN terms do not apply to them. ---------------------------------------------------------------------- tankerkiller125real · 2023-10-05 19:53 Personally I'd still be concerned, especially given that Warp on Android for example will not proxy YouTube or Netflix (it straight up won't allow it). ---------------------------------------------------------------------- lucassou · 2023-10-05 20:13 Thanks for sharing ---------------------------------------------------------------------- 010010000111000 · 2023-10-05 22:49 True but not every open source project is managed the same. Some are better at patching and reviewing security concerns. ---------------------------------------------------------------------- bobbyfilet327 · 2023-10-05 23:12 I think it still breaks tos "Cloudflare reserves the right to disable or limit your access to or use of the CDN, or to limit your End Users’ access to certain of your resources through the CDN, if you use or are suspected of using the CDN without such Paid Services to serve video or a disproportionate percentage of pictures, audio files, or other large files." ---------------------------------------------------------------------- bobbyfilet327 · 2023-10-05 23:13 Their tos says "Cloudflare reserves the right to disable or limit your access to or use of the CDN, or to limit your End Users’ access to certain of your resources through the CDN, if you use or are suspected of using the CDN without such Paid Services to serve video or a disproportionate percentage of pictures, audio files, or other large files." ---------------------------------------------------------------------- jared252016 · 2023-10-06 01:51 I use daisy chained reverse proxies through NginxProxyManager plus Cloudflare on a custom domain. I use the docker container Cloudflare-ddns which uses the Cloudflare API to keep my IP address updated. It does require editing some rather nasty looking config, but once set up it just works. I also use a wildcard subdomain for added security. You set jellyfin.example.com in NPM and *.example.com points to your IP in Cloudflare. NPM needs to do lets encrypt and youll need to enable full encrypted on the SSL/TLS between the two. When doing lets encrypt use a wildcard domain for the cert and obtain it via Cloudflare API. Otherwise your domain gets put on a list and people will find it. It's also not advised to use something simple, like jellyfin.example.com and instead use jellyfin-1.example.com or jfin.example.com as tools will check for the presence of the jellyfin subdomain. This is the best security you can get while still being compatible with the Jellyfin apps on Firestick, Roku, and Smart TVs. ---------------------------------------------------------------------- TooGoood · 2023-10-06 03:56 if your domain provider has Cpanel it comes with a DNNS web link that you can set up to just get your server to load their weblink to update your IP address. Many other DNS providers also have this option. ---------------------------------------------------------------------- ZealousidealDoubt903 · 2023-10-06 04:39 Daisy chained? 👀 pls elaborate ---------------------------------------------------------------------- Dogeek · 2023-10-06 06:56 If you want to share that service with others, yeah a custom domain is probably the way to go, but you'll have to add a few services to your self hosted stack to get there. - You need to open ports 80 and 443 on your router (to avoid specifying the port in the URL) - You'll need to buy a custom domain - You'll need a service to update that custom domain's A records to point to your public IP (if using cloudflare as your DNS provider, you can self host `cloudflare-ddns` for that) - You'll need a reverse proxy (traefik, nginx, apache your choice, though traefik is the more modern one of those imo) - You'll need to set up SSL certificate generation/renewal. You can use Let's Encrypt for that (either certbot on the machine or cert- manager if on kubernetes) - Optionally, you may want to secure your jellyfin instance with a third-party authentication solution (jellyfin has first-party support for LDAP, so you can add lldap to your self hosted stack, it has nice setup guides) If you don't want to bother with all of that you could also selfhost a VPN service like wireguard, or openvpn. That would allow your friends to connect to your LAN and access your jellyfin instance through its private IP address (which is not as nice, but it's secure, avoids firewall issues, avoids problems with changing public IP addresses if the VPN server is on a static public IP like on a VPS) Option 1 is obviously nicer. If you want to avoid the buying a domain part, and the automatic DNS updates you need, you can use a dyndns service like OVH's dynhost, duckdns, dyndns or other to handle that part for you. It might make it way harder to setup SSL certificates though (because you won't own the domain, so you'll have to use ACME HTTP challenges instead of DNS ones which are way easier to setup) ---------------------------------------------------------------------- lucassou · 2023-10-06 07:39 Yeah definitely I've just mentionned that is possible to control access. My ISP uses cgnat so I'm always a bit stuck with cf tunnels or headscale / tailscale to reliably access services in my lan ---------------------------------------------------------------------- __bharath_ · 2023-10-06 13:13 Once you have a domain \[use duck DNS as others have suggested\] There are a couple of ways. 1) Tailscale - You can make ur homeserver/jellyfin server a tailscale exitnode and connect to it whenever needed. 2) Similarly, you can use openvpn/wireguard. 3) **BEST in my opinion -** If you have a VPS, install Headscale on VPS and Tailscale on jellyfin server and connect to headscale as exit node. Now use a reverse proxy (like caddy/nginx/traefik) to forward the requests to tailscale IP:port of homeserver running jellyfin. \[Also implement Fail2Ban and GeoBlock IP for safety\]. Open ports 443 on the VPS and it should work. I am using this, and works really well. No need to use tailscale app on clients (because we are accessing VPS which forwards the request to jellyfin server via reverse proxy), and works flawlessly. Another way :- Cloudflare tunnel - They recently removed the TOS which states, that only Html content should be tunneled etc.. But i would still be skeptical about this. ---------------------------------------------------------------------- water_we_wading_for · 2023-10-06 18:42 Thanks. Makes sense.