A few Questions about reverse proxies and running your own Jellyfin server

Submitted ⁨⁨1⁩ ⁨year⁩ ago⁩ by ⁨KpntAutismus@lemmy.world⁩ to ⁨selfhosted@lemmy.world⁩

First things first, the setup is currently up and running. but i would like to modify it to use a reverse proxy through my personal domain.

Currently, i’m using an old pc with Truenas and a jail with jellyfin in it. i’m connecting to it with the free Fritz!Box VPN service.

but that’s stupid and slow. so i’ve bought a domain at godaddy.com. but i don’t understand the principle of whatever is managing the domain knowing the public IP-adress of my server. i’ve heard of Caddy, but it’s also running locally, so i don’t understand how i connect the pc to the domain.

if anyone could simplify this down for me, it’d be very helpful.

source

Comments

Sort:hotnew top

nekusoul@lemmy.nekusoul.de ⁨1⁩ ⁨year⁩ ago

i don’t understand how i connect the pc to the domain.

Yeah, that’s the part where I think there’s some misunderstanding. You don’t “connect” the server to your domain. Instead, there is a Nameserver (most run by your registrar, GoDaddy) that hosts a list of DNS records, that you can edit, which point to IPs. If that’s set up properly and points to your public IP and the port forwarding is set up properly in the Fritz!Box you should be able to connect.

That said, what’s wrong with VPN? Particularly if you’re using Wireguard VPN, which was recently added to Fritz!Box, there shouldn’t be any performance differences. Plus, it would be safer than exposing services to the whole internet, particularly if you’re not a networking expert.

source
- KpntAutismus@lemmy.world ⁨1⁩ ⁨year⁩ ago
  I‘m trying to set it up so i don‘t have to switch VPNs on my phone all the time. Also my Company IPad doesn‘t allow me to set up my own VPN connection.
  
  source
  - RootBeerGuy@discuss.tchncs.de ⁨1⁩ ⁨year⁩ ago
    I am not sure you should be connecting from a Company ipad to a Jellyfin server anyway. Well, unless its your own company I guess. Company IT may monitor what you are doing on it.
    
    source
    -> View More Comments

Decronym@lemmy.decronym.xyz ⁨1⁩ ⁨year⁩ ago

Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:

Fewer Letters	More Letters
CGNAT	Carrier-Grade NAT
DNS	Domain Name Service/System
HTTP	Hypertext Transfer Protocol, the Web
IP	Internet Protocol
NAT	Network Address Translation
SSL	Secure Sockets Layer, for transparent encryption
VPN	Virtual Private Network
nginx	Popular HTTP server

[Thread #241 for this sub, first seen 25th Oct 2023, 10:45] [FAQ] [Full list] [Contact] [Source code]

source

rentar42@kbin.social ⁨1⁩ ⁨year⁩ ago
There's plenty of reasons why you would not want to have a Jellyfin server be publicly available (even behind authentication). It's simply not a well-secured system at this point (and may not get there for a long time, because it's not a focus).

I strongly suggest keeping it accessed via VPN.

But note that VPN access is not necessarily any slower than "publicly" serving the HTTPs directly, at least not by much.

If you don't already use Wireguard as the protocol, then maybe consider running a wireguard VPN instead, that tends to be quicker than classic OpenVPN.

And last but not least: a major restricting factor in performance of media servers from afar is the upload speed of your ISP connection, which is very often much lower than your download (100Mbit/10Mbit are common here, for example, so only 10% of the speed up than down).

source
biddy@feddit.nl ⁨1⁩ ⁨year⁩ ago
There’s a nice explanation of how caddy reverse proxies work here. caddy.community/t/…/9427

Essentially you setup your router to port forward any new incoming connections to Caddy, which then decides what to do with them according to the configuration (Caddyfile).

Even simpler: Your local network is like a castle, inside is a safe and secure place where your devices communicate freely. Your router is a firewall around the castle, by default it blocks incoming connections. This is good because the internet is scary. By port forwarding you allow a door in the firewall which leads to Caddy, which is like a guard. Caddy asks them what they want, and if they say e.g. jellyfin.example.com, then it sets up an encrypted connection with https to your local jellyfin server. If they want anything else they aren’t allowed in.

source
Giu176@lemmy.world ⁨1⁩ ⁨year⁩ ago
I use Caddy as a reverse proxy for my jellyfin instance instead of Nginex, I think that they are both valid, another thing other people said in the comment is to access jellyfin via wireguard tunnel and I confirm that is the best choice if you don’t have specific needs, let me explain. The reverse proxy automatically generates ssl certificates using let’s encrypt allowing you to cast from an android phone to a Google chromecast (this seems to be the only way to do it and works very well for me). I also configured other services on caddy, in my setup I block every request to the reverse proxy that doesn’t arrive from inside my local network (except jellyfin so I can use it remotely), I know that it’s not the intended use of a reverse proxy but it makes some things possible that otherwise will need more configuration:

I have two separate networks in my home, my reverse proxy has a double interface so I can easily access all services from devices on the main network.

I don’t need to configure local dns rewrites to my services neither I have to add exceptions for dns rebind inside my router, I simply add a new rule to caddy and it just work.

I have https for every service on my network without annoying messages on the browser.

If you think this lazy use of the reverse proxy could be a problem please tell me your thoughts!
source
ShellMonkey@lemmy.socdojo.com ⁨1⁩ ⁨year⁩ ago
It depends on what all you want to proxy in, if it’s just that one thing then it’s pretty simple to point a port inbound to a secure interface and call it a day.

For a more complete thing, an inbound proxy will take the requested domain coming into your front door and translate it to an IP/port combo on the inside. That way you can have several services behind the single IP. If you have a full gateway server setup in frontt of things something like HAProxy or squid can work and do SSL offloading for you. For a single server setup you might look at ‘nginx proxy manager’ (NPM) which gives an easy way to set up an inbound proxy plus it’ll manage getting certificates from let’s encrypt automatically.

I could help more fully but need a good bit more details to give some specific ideas.

source
- Pok@lemmy.world ⁨1⁩ ⁨year⁩ ago
  If I wanted to access my Jellyfin at home from a smart TV elsewhere, is that possible (securely)? Or would I need something that can run a vpn?
  
  source
  - ShellMonkey@lemmy.socdojo.com ⁨1⁩ ⁨year⁩ ago
    With the caveat that I’m presuming Jellyfin has a HTTPS interface, or you have a proxy in front of it to make one for it (I use Emby myself but I Believe Jellyfin was a fork of it at some point) then yes, if the TV has an app for it you should be fine. HTTPS is as good on your server as anywhere else so long as it doesn’t have some implementation flaw. In fact it’s probably better to not have a VPN when streaming video just to avoid the extra overhead bandwidth a VPN tends to add on.
    
    My only thought against having it on the public web would be the potential for brute force attempts on the login page. If it has a 2 factor option then great, or even if there’s some kind of lockout/throttling after too many wrong guesses. Even barring that though, a decent long pass should be good enough to dissuade anyone from wasting toouch time trying to remotely get into a video box, not exactly a crown jewel target after all.
    
    source
apochryphal_triptych@lemmy.world ⁨1⁩ ⁨year⁩ ago
I just recently set up a reverse proxy with Nginx Reverse Proxy, and Cloudflare. I pointed my domain to my home address with Cloudflare (they have dynamic DNS capability), then set up NRP, to forward traffic by subdomain. The nice thing about the reverse proxy it is I can bind a subdomain to an ip:port on my local network. Like “music.MYIP.com” goes to my Navidrome instance “LOCALIP:4553”. This allows me to close unnecessary outbound ports.

source
ErwinLottemann@feddit.de ⁨1⁩ ⁨year⁩ ago
is the free vpn service the wireguard one? if yes and it is slow, than it won’t be any faster when using your own domain and exposing the server directly to the internet, because wireguard should be as fast as any direct connection. if it is not the wireguard vpn from the fritz box i’d recommend switching to it. this can be done by tge server jellyfin is running on if your box does not support wireguard.

source
KpntAutismus@lemmy.world ⁨1⁩ ⁨year⁩ ago
i may have figured something out, godaddy doesn’t support ddns, but you can change the ip of an A record via the API. and i have found a program that runs under linux as a service that does exactly that. problem is, where in my nas do i run it? do i try to install it in truenas? or jellyfin? or do i create a new jail with the sole purpose of running said program?

source
- ShellMonkey@lemmy.socdojo.com ⁨1⁩ ⁨year⁩ ago
  It should work from just about anywhere in your network. Most of those DDNS clients end up using an external IP lookup service to get their public address and then send that reply to home base to update the record.
  
  source
- qjkxbmwvz@lemmy.sdf.org ⁨1⁩ ⁨year⁩ ago
  I suspect you can have GoDaddy use a CNAME record which points to a DDNS entry (which has an A record). I have done that with different services before.
  
  source
Sallp@lemmy.world ⁨1⁩ ⁨year⁩ ago
Depending on how many people you want connected, could try something like tailscale or zerotier. I been using tailscale and I think it is easier.

source
TCB13@lemmy.world ⁨1⁩ ⁨year⁩ ago
Your basic requirements are:

Some kind of domain / subdomain payed or free;

Home ISP that has provides public IP addresses - No CGNAT BS;

A dynamic DNS service such as freedns.afraid.org;

Configure your router to forward your jellyfin port to the server.

The working principle is: your home has a dynamic IP address that might change at any time. You’re going to use a dynamic DNS service do to have a domain name that always points to the correct IP. To accomplish this you’ll be required to install a small tool in your server that monitors your public IP and whenever it changes calls the dynamic DNS service with the update. The best part is that you don’t even need to own a domain for that.
source
ryan_harg@discuss.tchncs.de ⁨1⁩ ⁨year⁩ ago
I assume you have a dynamic ip. what I did for that scenario: setup a dyndns hostname somewhere, configure a subdomain (e.g. jellyfin.example.com) with a cname dns record pointing to the dyndns hostname. you will have to setup updating of the dyndns jostname, this can be done in the fritz box and port forwarding to your jellyfin pc.

source
- jbloggs777@discuss.tchncs.de ⁨1⁩ ⁨year⁩ ago
  IPv6 may also “just work” nowadays, too, especially if the aim is to connect from mobile or other consumer networks. Corporate environments are still hit & mostly miss.
  
  source
  - ryan_harg@discuss.tchncs.de ⁨1⁩ ⁨year⁩ ago
    you mean without a dynamic hostname in between? but then you would still need to know about a changed prefix, wouldn’t you?
    
    source
    -> View More Comments