Security of Streaming 'Media ISOs' with reverse proxy reddit / selfhosted ---------------------------------------------------------------------- natypie · 2023-11-21 00:42 One of the popular uses of self hosted, is having a home media server for streaming your movies and series. I've configured services like Deluge to download the media through PIA VPN with gluetun. This part is secure. HOWEVER... I configured JellyFin to be able to stream remotely. To avoid reduced bandwidth, will not route this service with PIA VPN. If I configure the Jellyfin service with a reverse proxy, and enable SSL with let's encrypt (Nginx PM): 1. Is the data encrypted? 2. will my ISP be able to know what movies or series are being streamed? 3. will the remote user be able to determine my external IP address? 4. will a DNS IP lookup (or another ways) identify my IP address? Is this a correct approach, or should I go a different path? Any help is appreciated. ---------------------------------------------------------------------- assclownsix9 · 2023-11-21 01:17 No Yes Yes No Yes No No ---------------------------------------------------------------------- RedditSlayer2020 · 2023-11-21 01:19 Based ---------------------------------------------------------------------- emprahsFury · 2023-11-21 01:30 If you access JF through the reverse proxy w/LE then: 1- yes 2- no 3- yes if the rp is co located at your house 4- yes if the domain points to your house ---------------------------------------------------------------------- zedkyuu · 2023-11-21 02:17 I wonder if it's even possible to use SSL with no encryption at all. Not weak encryption, but none whatsoever. What would become of the initial key exchange? ---------------------------------------------------------------------- natypie · 2023-11-21 02:26 What is LE? ---------------------------------------------------------------------- natypie · 2023-11-21 02:29 Based on the answers, security is non-existent. How are people self hosting a home lab, if everything they do is exposed 🥺 ---------------------------------------------------------------------- emprahsFury · 2023-11-21 02:31 Let's encrypt ---------------------------------------------------------------------- natypie · 2023-11-21 02:36 Based on your answer, security is non-existent. How are people self hosting a home lab, if everything they do is exposed 🥺 ---------------------------------------------------------------------- emprahsFury · 2023-11-21 02:37 It's called the null cipher. It's unlikely any compliant server will accept actual data exchange using it. ---------------------------------------------------------------------- natypie · 2023-11-21 02:42 Thinking of a way to hide my Home IP. 1. Does it make sense to think of something like: 1. Option 1. My Domain Name > Tunneled through CloudFlare > Reaches my Home Router > NGINX directs to specific por on my HomeServer > Reaches JF ... 2. option 2. I've heard or WireGuard.. would this create a Tunnel, then I bridge my Docker Containers through it, then the end user can connect to, and everything be hidden and secure? IDK just imagining a solution. ---------------------------------------------------------------------- PowerfulAttorney3780 · 2023-11-21 02:58 Don't give your Plex library to people you don't trust ---------------------------------------------------------------------- DrunkOnKnight · 2023-11-21 03:03 I use option 2 but for a a different reason. I have CGNAT isp meaning I can’t port forward. Get a VPS doesn’t need to be powerful as you only setup a wireguard tunnel and a reverse proxy. Setup a wireguard tunnel from your VPS to your home server. And setup a reverse proxy, I don’t use docker for this because it’s one service, that would be overkill. Configure your reverse proxy to use the interface of your home servers wireguard tunnel and for the ports use whatever services for example, Jellyfin-subdomain.mydomain.tld points to 10.0.0.2 the interface of my home servers wireguard tunnel. With port 8096 for jellyfin or something else if you changed it. Also don’t forget to configure your A records to point to the public IP of your VPS. I just use a wildcard so it’s hard to track down what subdomain I’m using. ---------------------------------------------------------------------- jared252016 · 2023-11-21 03:24 1. Yes, with a reverse proxy such as Nginx Proxy Manager it's encrypted using Let's Encrypt certificates 2. No, not unless you screw up and port forward Jellyfin and set your reverse proxy in the cloud without a VPN 3. Yes, unless you use a VPS (Virtual Private Server) and dual reverse proxy or VPN+RP. It's against Cloudflare's terms I believe to host streaming media behind their cache. 4. Yes, same as 3. I personally allow my IP to be exposed and use a wildcard subdomain for added privacy. Have not had any issues except for with let's encrypt. I for some reason was still seeing a lot of traffic on my subdomains despite them not being listed anywhere. Turns out using let's encrypt does list you somewhere. To avoid it you need to register a wildcard certificate and use DNS to authorize it. Also, using a domain that wouldn't be easily guessed may also help. There is such a thing as a dictionary attack on DNS too, so use hyphens and maybe your initials in each subdomain. Like jdw- jellyfin.mysite.tld. If you're truly paranoid you can set up oauth2-proxy and put jellyfin behind it, but it'll break any client use (such as Roku or Smart TVs) ---------------------------------------------------------------------- natypie · 2023-11-21 04:20 To understand what you proposed. I made a diagram: [https://drive.google.com/file/d/1QaaqZXjgsTuUl-Ev- Es6B-rPG-2yOpjR/view](https://drive.google.com/file/d/1QaaqZXjgsTuUl- Ev-Es6B-rPG-2yOpjR/view) What do you think? I was unsure.. does the reverse proxy and WireGuard go on the VPS or on my Docker Home Lab. Will the data pass through the VPS (I ask since I noticed VPS's have limited bandwidth). Thank you in advance for your help ! ---------------------------------------------------------------------- pm_something_u_love · 2023-11-21 06:01 I do the same thing (except manually set up nginx server blocks since I'm old school), and I also have a static IP. Never encounted any issues. I feel pretty comfortable putting nginx out onto the web, it should be pretty secure.