Hi y’all, thanks for the help with my question yesterday. I did a bit of homework, and I think I’ve got things figured out. Here’s my revised plan:

  1. configure a cron job to update DuckDNS with my IP address every 5 minutes

  2. use ufw to block all incoming traffic, except to ports 80 and 443, to allow incoming traffic to reach Caddy

  3. configure the Caddyfile to direct traffic from my DuckDNS subdomain to Jellyfin’s port

Does this seem right this time? Am I missing anything, or unnecessarily adding steps? Thanks in advance, I’ll get the hang of all this someday!

  • frongt@lemmy.zipEnglish
    22·
    26 days ago

    I still don’t recommend putting jellyfin on the Internet. It’s not designed for it. There are some API endpoints you can access without authentication, not to mention potential authentication bypass vulnerabilities.

    5 minutes is also probably too frequent. Leases are usually significantly longer. You might hit a rate limit and get blocked.

    • compostgoblin@lemmy.blahaj.zoneOPEnglish
      2·
      26 days ago

      Thanks for the tip! I’ll back the refresh rate off to be safe.

      I’m not sure I entirely understand your concern about putting Jellyfin on the internet. A large part of my interest in selfhosting is being able host my own music library, my own cloud storage, etc, and access it as an alternative to Spotify or Google Drive. Doesn’t that inherently mean that they need to be on the internet, if I want to be able to access them when I’m away from home?

      My goal has been to find a way to do that safely, but if that’s not possible, that’s good to know too, so I don’t keep trying to do the impossible.

      • AbidanYre@lemmy.worldEnglish
        4·
        26 days ago

        Wireguard or tailscale are much better ways of accessing jellyfin from outside your network.

          • frongt@lemmy.zipEnglish
            21·
            26 days ago

            Provide them with VPN access. If that’s too much for them, then they don’t get access. Tough. On the scale of security vs convenience, that’s nothing.

            If you really really want, you should at least see if you can put a WAF in front, and put the server itself somewhere it doesn’t have access to the rest of your network (a DMZ) so that if and when it gets hacked, it doesn’t compromise the entire network.

          • ExperiencedWinter@lemmy.worldEnglish
            01·
            26 days ago

            I highly recommend Tailscale, you can share machines/services with unlimited friends on the free tier, and all of the actual auth stuff is handled by someone who isn’t me.

      • dogs0n@sh.itjust.worksEnglish
        31·
        26 days ago

        It’s honestly just a matter of how much risk you are comfortable with for using jellyfin on the open internet.

        (If i remember correctly:) The unauthenticated routes thing can only be used for streaming your content without a login (if you can guess the contents ids on your server I believe).

        In my opinion, it’s not worth the hassle of using a vpn because I don’t think this risk is worth mitigating with one.

        But everyone has their own personal risk assesment of course.

        P.s. Easier than a VPN, at least for logging in other users, would be to use some type of proxy authentication like Authelia. I believe jellyfin has a plugin you can use. It can be complicated to setup, but it’s an option. I believe it should protect all routes exposed by jellyfin so that solves the unauthenticated streaming issue. (I still dont think this is necessary but more choice for the risk-adverse!).

        https://github.com/authelia/authelia

    • FreedomAdvocate@lemmy.net.auEnglish
      15·
      26 days ago

      It’s not designed for it

      Yet everyone in here tells everyone to switch from Plex, which is designed for it, to jellyfin lol