Klox

Get a router/travel router and set it up as a gateway where it provides its own SSID for the Roku to connect to. A lot of them have baked in Tailnet/Wireguard support. iNet are generally good products.

to get something that is idiot proof.

The problem with Jellyfin in particular is that it needs to support binary streaming protocols. You can implement some gateway/firewall-based security in front of Jellyfin, but in the end it is still Jellyfin’s internal mechanisms mostly responsible for its own security. I don’t use Authentik but I have read many good things. The only real “advantage” of it is that it forces your users to somewhat better credential handling. Jellyfin still only supports LDAP, so the users will have to enter their Authentik username and password – very similar to just local accounts managed by Jellyfin. So IMO, not offering you that much extra in terms of security. You will be better served by firewall tools like fail2ban, crowdsec, geo-fencing, etc.

Depending on where/how your users access Jellyfin you could have something a bit tighter. If they never run it on a TV you could do something more advanced like mTLS where you issue them a certificate with a TTL of several years, walk them through installing it on their phones/laptops, and then have that in a reverse proxy. But at that point you might as well walk them through setting up a VPN mesh network.

For Seerr, it’s just a standard web app .You could put a reverse proxy in front that requires OIDC with Authentik. Seerr is also pretty close to having native OIDC integration. Personally I prefer having two rounds of OIDC – reverse proxy really narrows what the public can see as a first layer.

For BookOrbit, I am not familiar enough with the Kobos. My guess is, you might put BookOrbit behind a reverse proxy that enforces OIDC, but you might have to allow a bypass for /api route. Then you’re relying on BookOrbit to authenticate all /api requests through AIP tokens. AFAIK this would look like the normal Kobo linking process, so no real difference. But then your BookOrbit web UI is locked behind OIDC authentication.

Yes I decided to play it as a run-up to Alan Wake 2 :) how is that game? Its on sale ATM so should probably grab it now.

Just finished Alan Wake American Nightmare. Not too special; glad it was short. I’m pretty far into Abiotic Factor but only play co-op with my cousin so that will be a bit still. I am just starting Cyberpunk 2077.

Just depends on the form factor, but I usually go with SFF. I went 10G last year and it’s been so great. Used low profile, dual port SFP+ module. One port has SFP+ to RJ45 to my modem. Other port is SFP+ passive DAC to a used Brocade ICX 2750.

I was Unifi gear and then went back to Opnsense :P. That shit is way too expensive to replace.

OPNsense on used dell optiplex. Very easy but it can do whatever you want to grow into as you learn more.

OIDC and zero signups for everything. I’ve been very happy with Pomerium (ZTNA) + Keycloak for all my public facing apps, although the free version doesn’t have any client signals which I was hoping for when I starteed.

My project this week is integrating the app logging I have into Crowdsec and start having Crowdsec do more analysis.

Literal entrapment. Everyone should be breaking this shit on first sight.