I’d strongly recommend reverse proxy, some sort of security like crowd sec or fail2ban and sperate auth (authelia, aithentik) in front of anything you’re opening to the internet. Just opening services directly up to the internet is choice I’d politely describe as brave.
Comment on Plex’s crackdown on free remote streaming access starts this week - Ars Technica
Scrollone@feddit.it 23 hours agoWhy not? It depends on your situation, but if you have a static IP or a dyndns service, you can just open a port to your Jellyfin and reach it from anywhere.
You can also stick a reverse proxy in front of it, if you want to feel safer.
Egonallanon@feddit.uk 22 hours ago
Scrollone@feddit.it 19 hours ago
How do you manage a separate auth (I imagine HTTP auth) with app clients?
RandomLegend@lemmy.dbzer0.com 23 hours ago
or use tail scale / headscale
Scrollone@feddit.it 23 hours ago
Yes, but that’s not always doable, e.g. on LG TV’s.
Pfifel@lemmy.world 22 hours ago
You can “proxy” tailscale networks, you’d need 1 device per household with tailscale running and accepting/advertising routes. Not sure if tailscale IP addressing works in that case though, and just doing it via private IP can get problematic with same network range in the household
LievitoPadre@feddit.it 21 hours ago
That would work. I did it with a LG tv: Have a server advertising the routes with tailscale and in your tv when you configure the connection select that server as gateway and that’s it.
hietsu@sopuli.xyz 22 hours ago
Any old Raspberry Pi on your network can forward a port from LAN to the Jellyfin server on Tailscale somewhere. Single iptables masquerade command should do the trick. Or if you happen to have a good router with owrt support you can run Tailscale there too.
Wispy2891@lemmy.world 22 hours ago
while not technically allowed by cloudflare TOS for the free plan, it’s possible to host jellyfin under a cloudflare tunnel