Let’scrypt and port forward. Sprinkle on some free ddns with a sync script/job to keep ddns pointing to your real public IP. Can even roll in some headscale if you’re feeling adventurous
Comment on Improve very slow library scans on Jellyfin 10.11 / 12 on spinning media
fuckwit_mcbumcrumble@lemmy.dbzer0.com 1 day agoInside the network you do, but not for remote access outside the network.
abcdqfr@lemmy.world 1 day ago
MaggiWuerze@feddit.org 1 day ago Feeling adventurous is exactly what you need if you decide to expose Jellyfin to the Internet (a reverse proxy adds nothing to security)
Blue_Morpho@lemmy.world 1 day ago
Jellyfin doesn’t open up your network unless you specifically allow remote access exactly like Plex. The only difference is Jellyfin doesn’t have the encrypted tunnel built in- you need to know it needs it and add it yourself.
Plex has had bugs that allowed remote access into your home’s Plex server. nvd.nist.gov/vuln/detail/CVE-2025-34158
GoatSynagogue@lemmy.world 1 day ago
That poster specifically said if you open jellyfin up to the internet ……
ragebutt@lemmy.dbzer0.com 1 day ago
Outside the network you still have to open your server to allow plex cloud to access it and potentially tunnel your traffic through plex.tv if a direct connection doesn’t work. This happens automatically but it does happen
With Jellyfin you just have to supply your own relay, like Tailscale or wireguard, which does require more setup but is completely free, means that you can stop your media traffic from being funneled through services that harvest your data (which plex absolutely does), and doesn’t go to shit if plex.tv goes down
chisel@piefed.social 1 day ago
You can do the exact same thing with Plex, you just don’t need to since automatic remote streaming is built in. In fact, the article’s solution is literally Tailscale.
You can also bypass plex authentication on any ip range you choose, so if you add your local network and plex’s auth service goes down, it’s no big deal.
ragebutt@lemmy.dbzer0.com 1 day ago
Yeah obviously, you can also use Tailscale to tunnel to whatever service you want (including just to the server itself). But if you’re bothering to override remote plex access with all this I don’t know why you wouldn’t just pick the option that doesn’t harvest your data and increasingly treat its customers as hostile
fuckwit_mcbumcrumble@lemmy.dbzer0.com 1 day ago
And that’s the key, it happens automatically and it just works. With jellyfin you have to expose the web server to the internet, or point an app to something else exposed on the internet. With plex you don’t. If you don’t want to (or can’t) a direct connection from your server to their servers, then their servers to your device is established. No VPNs, no reverse proxies, no port forwarding, nothing exposed to the rest of the internet.
ragebutt@lemmy.dbzer0.com 1 day ago
They won’t do that because it’s expensive and free software generally doesn’t have the budget to do this
I don’t know why you think the “just works” is any different from tunneling with a service. Your server is still opened to the internet through upnp with direct connections and through a tunnel to plex.tv when a direct connection is not possible. In fact plex is inherently less secure because their infra is both the encryption endpoint (as opposed to your client with Jellyfin and Tailscale or whatever) and their infra has been vulnerable in the past (like the massive breach in 2022).
Jellyfin with something like nginx and a vpn is open to the internet, yes, but a service that tunnels (like wireguard, Tailscale) bypasses this issue and it’s up to you to set it up as to your level of comfort
Plex is just easier but as with all things tech (especially those infected with VC dollars) “ease” translates to less secure and far more likely to exploit your data
I came up with a funny strategy I use to lock it down a bit. What’s exposed to the internet for me is Apache2 reverse proxy. The proxy is locked down to reject all connections EXCEPT for the ones coming from a special subdomain which is something like a 64-character long random string. This prevents pretty any unwanted connections. Obviously the special subdomain must remain as secret as a shared password among the Jellyfin users. It works for trusted users.
What I want ideally is an “authenticated firewall.” OpenWrt rejecting all connections on the open port except for an allowlist of IPs. Then there must be a system where users can authenticate and their IP is added to the allowlist. I haven’t found an off-the-shelf solution like this but I’ll make it some day. Too bad I figured this random string subdomain trick cause it seems good enough for now. :D
JustEnoughDucks@feddit.nl 1 day ago
It is literally a cloudflare tunnel/ tailscale type thing but contained in the app. The only real difference is that it is bundled in the app, so less setup and in exchange, Plex itself is free to harvest all of your data.
fuckwit_mcbumcrumble@lemmy.dbzer0.com 21 hours ago
That’s the key. It just works. No extra setup necessary.
And more importantly, I do t have to have my 60 year old mom do some additional setup in her end. Just install the app, and go.
NewNewAugustEast@lemmy.zip 1 day ago
Well except during the Plex outage today.
And last week.