Jellyfin/Plex Public Facing or VPN? reddit / selfhosted ---------------------------------------------------------------------- Ejz9 · 2023-12-25 04:03 Currently I have my jelllyfin server setup as public facing. Accessed through my domain. Would a VPN be more advisable? I know a VPN is safer but if you have a device that can’t use one or you don’t want to have to deal with one (although I use tailscale which is incredibly easy to setup/use) should you still try to use a VPN? What’s your thoughts? ---------------------------------------------------------------------- TryNotToShootYoself · 2023-12-25 04:33 You're probably completely fine with a public facing Plex server. Just make sure the device you're running it on is secure, and that your ISP or network administrator (if applicable) is fine with it. I personally don't use a VPN for my Plex server because I share it with a lot of people and don't want to force them to install tailscale or wireguard on all their devices. ---------------------------------------------------------------------- Gaming09 · 2023-12-25 05:29 For jellyfin you use a reverse proxy to access or VPN. I would lockdown your access by geo location. Have VPN as backup. Keep jellyfin updated . ---------------------------------------------------------------------- nosyrbllewe · 2023-12-25 05:58 As a word of caution, Lastpass was previously hacked because of an employee's outdated version of Plex. So, while it should likely be fine if properly maintained, there is still definitely some risk. ---------------------------------------------------------------------- Ejz9 · 2023-12-25 06:17 Precisely, I don’t want to create this “burden” to have the VPN. My device is secure as I am aware. I should probably change container permissions but they also scale with video card access so debatably complicated. My last and now new current ISP (as of last Wednesday) I know do not allow such a thing. Technically speaking at least, but I am not hosting major business services, just access to some friends/family, nor am I charging. Therefore it’s not business use in a reality. Obviously this is not a permanent garuntee but it is what it is. It’s not enough to disrupt their network to my understanding either. ---------------------------------------------------------------------- Ejz9 · 2023-12-25 06:19 I have that auto updating and fix stuff as it breaks (if it does). So theoretically shouldn’t be an issue. I do use vaultwarden though so it’s the trust I put in myself I guess. ---------------------------------------------------------------------- Ejz9 · 2023-12-25 06:25 Awesome thanks! I’ll look into hardening my access rules further if I can! ---------------------------------------------------------------------- qksv · 2023-12-25 22:34 I use the Caddy reverse proxy, very simply to use and handles the whole certificate process. To jellyfin, and all the other subdomains, I ensure logging is enabled as well as basic auth (basically a password around a password-- I don't expose even the login page). I then have crowdsec parse those logs. So far, I have mostly only succeeded in blocking myself, which to me means that it probably is working! ---------------------------------------------------------------------- Ejz9 · 2023-12-25 23:38 That reminds me I need to change my whitelisted IPs in fail2ban 😄! Got new internet so now it’s outdated. Nice though, what are you using for the auth? Cloudflare access? Authelia? Is it built into caddy? I’ve never messed around with a reverse proxy that I have to edit files for. I’ve never needed anything more complex than NPM though either, however switching to caddy, or another may prove worthwhile in the end. ---------------------------------------------------------------------- qksv · 2023-12-26 01:20 Caddy has a one liner that allows you to put domains behind HTTP basic authentication https://caddyserver.com/docs/caddyfile/directives/basicauth ---------------------------------------------------------------------- Ejz9 · 2023-12-26 03:49 Huh cool! ---------------------------------------------------------------------- Ill-Engineering7895 · 2023-12-27 09:47 Take a look at this list and decide whether you are comfortable with these risks of exposing it without vpn https://github.com/jellyfin/jellyfin/issues/5415 ---------------------------------------------------------------------- Sky-Is-Black · 2023-12-29 08:15 Why would your plex users need to install or connect to the VPN? Just for your server should be good enough? Am I wrong?