Own domain for Jellyfin and privacy concerns

Submitted ⁨⁨4⁩ ⁨hours⁩ ago⁩ by ⁨dingleberrylover@lemmy.world⁩ to ⁨selfhosted@lemmy.world⁩

Hi everyone,

a couple of friends and I have a Jellyfin server running which is exposed to the internet via a reverse-proxy and https by using a free dynDNS provider.

The setup is working fine besides the dynDNS provider. We constantly face connection issues, making the dynamic DNS functionality very unreliable.

So I started looking into possible solutions and one particular would be to buy an own domain which would only cost a few bucks each month. With this I could keep the current setup and would just need to change the domain (and possibly the SSL certificate). I found a provider over which I could buy (rent?) a domain and which also provides dynDNS functionality. But I am not too sure if I understood this correctly:

if I have an own domain, why would I need the additional dynDNS functionality? I would guess that I would just continue updating your server’s IP address to the domain name like we are doing now
can the provider over which I rent the domain with servers in my country actually see what our traffic is? Especially since we are streaming our movies etc.
is there a better way of obtaining and setting up your own domain also in terms of privacy and reliability than with a bigger company offering such services?

Thanks a lot for your feedback!

source

Comments

Sort:hotnew top

teslasaur@lemmy.world ⁨3⁩ ⁨hours⁩ ago
Dyndns really shouldn’t affect your connection, as long as you have a local client that updates your record automatically.

I use jellyfin together with caddy and it was pretty seamless to setup. I configured the caddyfile to redirect my incoming domain to my local ip and the rest worked automatically. It sets up a legitimate certificate for the domain using lets encrypt and automatically renews it.

When you have an encrypted connection, the isp can’t see what is being sent between you and the webserver. They can however see your dns-requests unless you have dns over encryption enabled.

The only security measure beyond keeping things up to date that i would recommend is to have a geo-blocker enabled for incoming traffic to your network.

source
- dingleberrylover@lemmy.world ⁨3⁩ ⁨hours⁩ ago
  Thanks, yes I also use a script that constantly sends the current IP address to the dynDNS provider. I could be completely wrong, but the internet connection of my friends house where the server stands is fine even during these connection issues. So I would blame the DNS resolution, but it is also my first time running a server.
  
  source
  - lorentz@feddit.it ⁨1⁩ ⁨hour⁩ ago
    How frequently do you send these updates? Most of dynDNS provider rate limit the updates you can send, so it is possible that you send a bunch of useless updates when the IP didn’t change and the actual update that is required gets discarded because you hit the limit.
    
    Do you log your script errors somewhere? Are you sure that the IP changes so frequently?
    
    I know at least 3 European fiber providers which offers static IPs. For broadband always on connections IP changes should be pretty rare
    
    source
    -> View More Comments
A_norny_mousse@feddit.org ⁨2⁩ ⁨hours⁩ ago

can the provider over which I rent the domain with servers in my country actually see what our traffic is? Especially since we are streaming our movies etc.

That’s what encryption is for, a.k.a. HTTPS in this case.

source
- kossa@feddit.org ⁨1⁩ ⁨hour⁩ ago
  But that is about the ISP (and all hops in between). The provider, where you buy the domain does not see the traffic at all. Basically the domain seller just controls tme nameservers for that domain, but doesn’t see the traffic that goes to those domains.
  
  Basically by buying a domain you buy an entry into the telephone book
  
  source
determinist@kbin.earth ⁨2⁩ ⁨hours⁩ ago
@dingleberrylover
I have a static IP provided by my ISP. I own my own domain name. I use BunnyCDN to manage my DNS.

On my server I run Jellyfin and reverse proxy with Caddy, I also run Fail2Ban. Caddy has built in SSL certification.

After I set it all up (which took me a few tries to get it all right as I was learning on the go) it just runs with no apparent problems. I check logs and monitor it regularly however so far I haven't had any problems.

The Jellyfin address is shared only to a few family members.

I'm in the EU so GDPR applies and none of the involved companies is datamining my stuff.
Their policies are to be non-invasive.

source
- dingleberrylover@lemmy.world ⁨1⁩ ⁨hour⁩ ago
  I am in the same boat (learning on the go, living in EU and using fail2ban and reverse proxy although I use nginx). Sounds good that it runs so well for you! Where did you register your domain? I’ll look into BunnyCDN as well.
  
  source
Zikeji@programming.dev ⁨3⁩ ⁨hours⁩ ago
Let’s back up some - a free dynDNS provider would not cause connection issues, unless DNS resolution itself stopped working - which is unlikely. It sounds more like the Internet you’re running off of itself has issues. What in particular is making you blame the dynDNS? Who is it?

source
- iturnedintoanewt@lemmy.world ⁨3⁩ ⁨hours⁩ ago
  … Check duckdns constant resolution issues. There’s lots of threads about their inconsistency and unreliability. Can’t really complain, because it’s truly free, but there’s no full week that goes without issue.
  
  source
  - Zikeji@programming.dev ⁨3⁩ ⁨hours⁩ ago
    Ha, if he said duckDNS I was going to recommend something more reliable like freedns.afraid.org.
    
    That being said, the description in his post doesn’t make it seem that way.
    
    source
    -> View More Comments
  - dingleberrylover@lemmy.world ⁨2⁩ ⁨hours⁩ ago
    For me it seems like to be a similar issue with the duckdns inconsistencies.
    
    source
- dingleberrylover@lemmy.world ⁨3⁩ ⁨hours⁩ ago
  I am using dynv6.com. The reason I blame the DNS resolution is because when I have issues connecting (as if the domain is not available), it does not mean that my friends cannot connect either. The server is at a friends house who has a fiber connection and who has no issues when we habe trouble connecting again. I could be totally wrong, but to me it sounds like dynv6 has some troubles.
  
  I also have a script running, which constantly updates dynv6 with our current IP address.
  
  source
  - Zikeji@programming.dev ⁨2⁩ ⁨hours⁩ ago
    Well, it can’t hurt to cross it off. You don’t need to get a domain from a registrar that offers dynamic DNS, you just need to register a domain (or try another dynamic DNS like the other user suggested) and use a DNS provider that is free and offers an API. I personally use Cloudflare, there are plenty of guides for setting up a dynamic record on CF.
    
    For registering a domain you can use an affordable registrar, I’m a Porkbun customer - for a .com domain it’s like $11 for a year. No need to spend monthly.
    
    source
    -> View More Comments
  - cmnybo@discuss.tchncs.de ⁨2⁩ ⁨hours⁩ ago
    I used to use dynv6, but I started having issues about 2 years ago. DNS records would just stop resolving until I deleted and recreated them. Their forum has been broken for years, so there’s no way to get support.
    
    If you only need 5 records or less, give FreeDNS a try.
    
    source
Strit@lemmy.linuxuserspace.show ⁨3⁩ ⁨hours⁩ ago
As someone else mentioned, this does not seem to be an issue with the DynDNS itself. But rather the fact that your ISP changes your IP regularly (DHCP, non-static IP). I would really recommend you get a static IP from your ISP. DNS lookups should never fail after that.

source
- dingleberrylover@lemmy.world ⁨3⁩ ⁨hours⁩ ago
  I have a script running which sends the current IP to our dynDNS provider. I would assume that this is fine then?
  
  source
  - Strit@lemmy.linuxuserspace.show ⁨2⁩ ⁨hours⁩ ago
    Sure, but until their DNS records update, the server is unreachable at the domain address.
    
    source
    -> View More Comments
Knossos@lemmy.world ⁨3⁩ ⁨hours⁩ ago
You are probably better off using something like Tailscale. You don’t need to expose your system with a reverse proxy then.

source
slazer2au@lemmy.world ⁨3⁩ ⁨hours⁩ ago
If you have a static IP where you host your jellyfin service you shouldn’t need your dydns anymore.

a domain provider doesn’t know what you are doing. It knows you want to access jellyfin.your.domain but has no clue what you are watching or the specific URLs you are going to.
Think of it like a library reference card, the library knows you want Encyclopaedia Britannica volume 12, but they don’t know what you are actually looking up.

I have a domain with porkbun and dont have issues. When my reverse proxy needs a new certificate I do nothing because Traefik uses the porkbun API to do the Let’s Encrypt DNS validation.

source
- lepinkainen@lemmy.world ⁨3⁩ ⁨hours⁩ ago
  Even if you have a dynamic IP it’s trivial to set up automatic DNS updates with a good provider that has an API to do it.
  
  source
Brkdncr@lemmy.world ⁨3⁩ ⁨hours⁩ ago
Can you explain the connection issues? Dynamic dns services aren’t much different than a normal domain name.

If the problem is with your ip address changing then you need to get a more permanent ip.

In fact you can usually get a domain name from the dynamic dns provider and they can update it.

A way around this is to use a service like Tailscale. Their ip address for your host won’t change. The downside is you need to be on von to access it. There might be other options.

source
- dingleberrylover@lemmy.world ⁨2⁩ ⁨hours⁩ ago
  The server is running at my friends house who has a fiber connection. When we face these connection issues, it does not necessarily mean that all of us cannot access Jellyfin but often times only a couple of us cannot access (same error as if you mistype a web-address, so it cannot resolve the domain name). During these periods of connection issues, the internet connection of my friend is working completely fine. I have a script running that constantly sends the current IP address to the dynDNS provider. I also looked into how often our ISP changes the IP address and it is not very often and not during these issues.
  
  source
  - Brkdncr@lemmy.world ⁨2⁩ ⁨hours⁩ ago
    A different domain name won’t fix the issue you’re describing.
    
    source