smiletolerantly

1. Signal
2. XMPP
3. Matrix

In that order. I self-host both XMPP and Matrix, and I wouldn’t want to stop using matrix. Spaces, arbitrary amounts of self-chats, and so on are great. I use matrix every day.

But for chatting… It sooner or later fails you. It’s slow. Notifications break. Messages are shown as sent, but somehow do not appear in the recipient’s devices until TWO WEEKS LATER (yeah IDK, happened twice already, in different chats and directions. Best part is, I’m not even federated!). Encryption is great IF YOU KNOW SOME CRYPTOGRAPHY BASICS, and utterly confusing otherwise.

XMPP just works. Especially the calls, holy shit, I had to fight Matrix for so long to make voice and video calls work, and xmpp just… Works. Notifications are way more reliable (as in, have been absolutely perfect). I really like monocles as a chat app on Android. (The downside is: can’t decrypt old messages on new devices, and desktop clients are ugly.)

So why Signal above XMPP?

Because it’s not your fault should something ever break in a vital service. Also the encryption and privacy afforded by it a great.

I’ll second Pocket-ID.

I originally had Authentik setup. It worked well enough. However, their packaging constantly broke and no-one seemed to care.

Switched to Pocket-ID and won’t be looking back. Passkey-based OAuth was all I wanted anyways. (Also, the logins themselves are noticeably faster!)

Which shouldn’t really be an issue since you should only host on 443, which tells bots basically nothing.

Configure your firewall/proxy to only forward for the correct subdomain, and now the bots are back to 0, since knowing the port is useless, and any even mildly competent DNS provider will protect you from bots walking your zone.

Sorry, saw this only just now. I don’t really have any guides to point to, so just the basic steps:

• host jellyfin locally, e.g. on 192.168.10.10:8096
• configure some reverse proxy (nginx, caddy, in my case it’s haproxy managed through OPNSense)
• that proxy should handle https (i.e. Let’s Encrypt) certificates
• it should only forward https traffic for (for example) jellyfin.yourdomain.com to your Jellyfin server
• create a DNS entry for jellyfin.yourexample.com pointing either to your static IP, or have some DynDNS mechanism to update the entry

90% of this is applicable to any “how to host x publicly” question, and is mostly a one-time setup. Ideally, have the proxy running on a different VM/hardware, e.g. a firewall, and do think about how well you want/need to secure the network.

In any case, you then just put in jellyfin.yourdomain.com in the hotel TV.

I have never used Tailscale. I have also Jever seen anyone in the wild recommend it and explain what exactly the use-case is beyond plain, old, reliable, open source WireGuard.

So yeah, agreed.

Also I have been hosting Jellyfin publicly accessible for years with zero issues, so idk… I also dint k ow what the “you have to use Tailscale for jellyfin” people are doing with TVs/Firesticks/… in hotels, airbnbs,…