Downloaded movies on self hosted server. reddit / selfhosted ---------------------------------------------------------------------- Specific_Daikon1921 · 2023-10-20 06:11 I'm using cloudflare tunnel to access my movie collection on selfhosted jellyfin. Jellyfin accounts are behind a strong password. Considering it's on the web, how bad is it? I'm not thinking about attacks, can I be flagged for piracy or things? Where does the ISP stand? ---------------------------------------------------------------------- ElevenNotes · 2023-10-20 06:17 Why does it need to be on the web and not on a VPN? ---------------------------------------------------------------------- symphonyalpha · 2023-10-20 07:20 I'm fairly certain using cloudflare tunnels to access jellyfin is against their TOS ---------------------------------------------------------------------- Specific_Daikon1921 · 2023-10-20 07:36 Because my router doesn't support VPN (ISP issued one) and i can't access my collection with my Chromecast other way ---------------------------------------------------------------------- Specific_Daikon1921 · 2023-10-20 07:36 Can't find anything anywhere. Any pointers? ---------------------------------------------------------------------- ElevenNotes · 2023-10-20 07:37 Bad answer. You can install the VPN server on the device where Jellyfin is hosted, and if you have CGNAT or something blocking your VPN (like no port forwarding) get Tailscale or you could ask your ISP for a modem and setup your own router. You have three options here, one will definitely work (Tailscale) the other two would be preferred though. ---------------------------------------------------------------------- bufandatl · 2023-10-20 07:43 https://blog.cloudflare.com/updated-tos/ ---------------------------------------------------------------------- TheRealAdreaner · 2023-10-20 07:50 I would suggest to put it behind an sso service like a self hosted authelia or authentik. So even if someone finds your website they will only see your authentication page and not what’s behind it. ---------------------------------------------------------------------- sebasdt · 2023-10-20 07:54 For multicast your should use zerotier as tailscale (wireguard) isnt at the right network level.. ---------------------------------------------------------------------- ElevenNotes · 2023-10-20 07:55 Why do you need multicast for a single TCP stream from Jellyfin to the client? ---------------------------------------------------------------------- Ben4425 · 2023-10-20 07:58 How would that work with a Jellyfin client running on a device like a Chromecast dongle? The code on the dongle doesn't (IMHO) know how to log into an SSO service. ---------------------------------------------------------------------- sebasdt · 2023-10-20 08:03 yeah not sure but interpreted: >...and i can't access my collection with my Chromecast other way as he wanted to connect to a Chromecast on the other side of the VPN. ---------------------------------------------------------------------- TheRealAdreaner · 2023-10-20 08:13 You would have to exclude the */api/ path in the authentik provide settings, so that if something wants to call the jellyfin api (like Swiftfin) it can go around the sso. It’s not the best practice for security but the only working way I have found. ---------------------------------------------------------------------- MoooNsc · 2023-10-20 10:23 i cant imagine a anti piracy organisation hacking into your server for the purpose of suing you ---------------------------------------------------------------------- AnApexBread · 2023-10-20 10:31 Yup. Cloudflare has historically been pretty lax about enforcing that as long as you're not pulling way to much data. But technically it is still against the ToS ---------------------------------------------------------------------- Wacci90 · 2023-10-20 12:13 I using Plex with 2FA. ---------------------------------------------------------------------- Franvcg · 2023-10-20 12:28 That's why I don't use any SSO for my exposed services, I only expose stuff that I want to connect to simple devices that can't run a VPN (like jellyfin to connect to a smart tv or home assistant to connect to iot stuff) everything else connects through a VPN. ---------------------------------------------------------------------- JiggySnoop · 2023-10-20 12:52 My jellyfin and jellyseerr both servers are open to web.because so many people using it i can't sacrifice accessibility.but i have hardcore monitoring,alert system and emergency shutdown systems in place. ---------------------------------------------------------------------- Reetin · 2023-10-20 12:56 I can't find the post and I am far too lazy to look it up in the TOS. Cloudflare had verbage in the TOS saying you can't use media content for tunnels. That like was removed within the last couple of months. I'm sorry I am too lazy to find it. ---------------------------------------------------------------------- mrpink57 · 2023-10-20 13:51 Jellyfin supports LDAP through authentik, it does also support SSO but would not work on a chromecast. Someone will hit the front page of your jellyfin server, but it is just important to setup strong passwords and I usually hide all accounts on main screen. ---------------------------------------------------------------------- mrpink57 · 2023-10-20 13:54 As long as passwords are strong it's usually fine, I use ldap through jellyfin on authentik and everyone gets a passphrase. ---------------------------------------------------------------------- AnApexBread · 2023-10-20 14:11 https://blog.cloudflare.com/updated-tos/ ---------------------------------------------------------------------- MRP_yt · 2023-10-20 15:02 *my friend told me,* He is using CF Tunnel for his Plex server for over a year now and so far no problems. Only 2 - 3 users accessing Plex over a week, not a lot of data being pushed between. ---------------------------------------------------------------------- RealKlopstock · 2023-10-20 15:50 Are jellyfin Servers behind a Reverse Proxy realy such a big Security risk? ---------------------------------------------------------------------- jfromeo · 2023-10-20 16:21 I would like to know aswell, because that is my case. JellyFin behind NPM listening on a non standard https port (4443) with a Letsencrypt SSL certificate I serve to plenty of family members with chromecasts, smarttvs, laptops, smartphones... that may be not compatible with SSO. ---------------------------------------------------------------------- PenguinMan32 · 2023-10-20 17:18 why not have nothing exposed and just use [tailscale](https://tailscale.com/) ---------------------------------------------------------------------- excelite_x · 2023-10-20 17:32 Why would that be a benefit? Jellyfin already provides a login screen (allegedly with strong passwords) ---------------------------------------------------------------------- Large_Yams · 2023-10-20 17:57 That's an odd reasoning when there are tools that make it perfectly secure and usable. ---------------------------------------------------------------------- Franvcg · 2023-10-20 18:08 Care to explain? ---------------------------------------------------------------------- TheRealAdreaner · 2023-10-20 18:09 Like I said. So even if someone find your domain to your jellyfin server they would only see Authentik. And if you start with authentik you could use it for much more self hosted services so you have one big login page in front of your services. ---------------------------------------------------------------------- Large_Yams · 2023-10-20 18:23 The first comment in this chain literally states two products to do it with. ---------------------------------------------------------------------- Franvcg · 2023-10-20 18:28 The second comment on this chain literally asks how would you be able to log into the authelia/authentik login page on a device that isn't capable of doing so. Guess you also doesn't know and just want to antagonize and feel superior. ---------------------------------------------------------------------- nyrosis · 2023-10-20 18:29 Mine is exposed and it works quite well for family use. I use nginx proxy manager to get it going with a cert. Security is pretty standard ufw to secure the lxc. I also have fail2ban setup though I'm considering switching to crowdsec ATM within the container. I may not considering everything has to pass thru my opnsense firewall which is using some nice intrusion prevention rulesets. The isp doesn't care about a jellyfin login page. You can do this with VPN if you prefer but this just makes it easier for services you want others to access. ---------------------------------------------------------------------- nyrosis · 2023-10-20 18:41 It's really not that bad especially if you setup access lists. That simple configuration alone eliminates most problems from even accessing the server. ---------------------------------------------------------------------- lvlint67 · 2023-10-20 18:44 If that's his goal he's in for a fuck of a time.... Chrome cast sucks once you leave a flat l2 setup ---------------------------------------------------------------------- adamshand · 2023-10-20 18:57 It's more of a risk than exposing something like Postfix/Dovecot/OpenSSH/WireGuard which have had a lot of eyeballs on them for a long time. But, I've had a Jellyfin server exposed to the world via Cloudflare tunnels for several years and never had any problems. 🤞🏻 ---------------------------------------------------------------------- LennartxD01 · 2023-10-20 19:10 Yup but aslong as you don't pull massive amounts of data they don't really care. Got my CF account locked for TOS after 5-6TB a month :D. ---------------------------------------------------------------------- Kagawan · 2023-10-20 19:14 Why would the other two be preferred? Currently using tailscale since it allows me to limit what I share in terms of endpoints. I just share my reverse proxy with tailscale and proxy them on to my server ---------------------------------------------------------------------- Candle1ight · 2023-10-20 20:40 I'm no specialty expert, but I've not had any problems for the 4? Years I've done it. It gets the occasional proving from crawlers, but nothing close to an actual attack attempt. ---------------------------------------------------------------------- ElevenNotes · 2023-10-20 21:05 And that is perfectly fine for you, so all is good. ---------------------------------------------------------------------- Large_Yams · 2023-10-20 21:06 Wtf. Dude. The third explains how to do it. Did you just not read any of the comments at all? ---------------------------------------------------------------------- vinberdon · 2023-10-20 21:24 Ooh, I like the sound of that. ---------------------------------------------------------------------- RB5Network · 2023-10-20 22:24 Dang. 5-6TB? What were you streaming? ---------------------------------------------------------------------- HrBingR · 2023-10-20 22:34 It used to be, but that clause now only applies to their CDN component. EDIT: https://blog.cloudflare.com/updated-tos/ ---------------------------------------------------------------------- MRP_yt · 2023-10-20 23:06 Could be a lot of NSFW ---------------------------------------------------------------------- Franvcg · 2023-10-20 23:28 Yeah I saw that, but he explains how to bypass the SSO on devices that don't support it, which kinda misses the point. It's not usable if you're bypassing it, might as well not have it for those exposed services. ---------------------------------------------------------------------- DonKanailleSC · 2023-10-21 00:17 Lol the downvotes are so unnecessary guys. He is here because he is asking for help and probably doesn't know much about self hosting a VPN. ---------------------------------------------------------------------- Electronic_Wind_3254 · 2023-10-21 02:29 why is this downvoted? tailscale works amazingly well.. ---------------------------------------------------------------------- SawkeeReemo · 2023-10-21 05:36 I really gotta find a straight forward install guide for Authelia. ---------------------------------------------------------------------- ButterscotchFar1629 · 2023-10-21 05:59 And you will be banned. Cloudflare does not permit non-html traffic over their tunnels. ---------------------------------------------------------------------- National-Dust-2194 · 2023-10-21 06:32 It used to be, but not any more. They only disallow video streaming if the videos are hosted on their CDN which wouldn't be the case for a Jellyfin server behind a CF Tunnel ---------------------------------------------------------------------- bobbarker4444 · 2023-10-21 06:35 Cloudfare offers an authentication service like that already. Really easy to set up in front of a tunnel ---------------------------------------------------------------------- bobbarker4444 · 2023-10-21 06:37 Same situation here but my users are all just friends and family so what I did was whitelist access from my own country and blacklist everything else. Not bulletproof of course but it did cut down on unintended traffic by nearly 100% ---------------------------------------------------------------------- bobbarker4444 · 2023-10-21 06:38 Can't speak for OP specifically but if someone is exposing Jellyfin to the web it's probably because they're sharing their library. Getting your friends and family to install tailscale is just not going to happen ---------------------------------------------------------------------- DWolfUK40 · 2023-10-21 19:37 Jellyfin is a media player. It’s built in security is more than enough for most. A lot use it for access to their own personal collections. You’re using it for your own use, you’re not distributing so doubtful anybody would care. There’s no way to know what’s there so not worth anybody’s time. Now if you were selling logins to that server and advertising the content then things would be different in the same way that if you seed pirated content they will care more than if you just leech it. For all they know you could have your personal home videos behind it or legitimate backups of physical disks you own. Hide it behind a subdomain and random path then unless somebody is looking for it they won’t stumble on it in the first place. This should be enough really. Jellyfin is designed to keep your content secure. The only way somebody official would come knocking is if they suspect there’s something to hide. Unless you tell people they have no reason to suspect. They have much bigger fish to fry. I don’t think you have anything to worry about but you can ofc secure things further if you want to jump through a few mostly unrequired hoops. That’s just my personal opinion. If you don’t feel safe exposing it then you shouldn’t and should setup a vpn or similar and hide it all behind that. My jellyfin has been exposed for years. Just me and my family using it. I’ve never had anybody try to access it. Nothing exciting behind it other than family videos but nobody knows that. ---------------------------------------------------------------------- LennartxD01 · 2023-10-22 11:13 That's indeed correct. Was public though.