Hello. I have just recently started with self hosting my media with Jellyfin... and I am LOVING it! I had been carrying around media players for decades, with everyone looking at me like an insane crank for not giving up on my hundreds of gigs of media for SAS things like spotify... now they're jealous! We've come full circle!
Annnyway. Obviously, I want to access the server anywhere, and don't want to just raw-dog an open port to the internet- yikes!
There are SO MANY ways and guides and thoughts on this, I'm a bit overwhelmed and looking for your thoughts on the best way to start off... it doesn't have to be 'fort knox' and I am sure I'll adjust and pivot as I learn more... but here are the options I know of (did I miss any?):
-
Tailscale VPN connection
-
Reverse Proxy with Caddy or similar (this is recommended as easy in the jellyfin official guides and thus is my current leading contender!)
-
Docker/VM 'containerized' server with permissions/access control
What are your thoughts on the beginner-friendly-ness and ease of setup/management of these? This is exclusively for use by me and my family, so I don't need something that's easy for anyone to access with credentials... just our handful of devices.
Please don't laugh, but I'm currently hosting on a Raspberry Pi5 with a big-ass harddrive attached (using CasaOS on a headless Ubuntu Server). I know this is JANK as far as self-hosting goes, and plan to upgrade to something like NAS in the future, but I'm still researching and learning, and aside from shitty video transcoding, it's working fine for now... Thank you in advance for your advice, help and thoughts!
EDIT: Thanks all for the helpful comments & Suggestions. I'm all set up with Tailscale, setting up Caddy with it soon, and so far, as advertised! EZPZ and soooo good!
Other user summarized very well.
No I have accrued knowledge of those things over time, no one stop shop that I know of. But knowing these things exist and their general use are half the battle!
I was lazy with the “Authentik wall” because I couldn’t remember what they called it. It is the “proxy” option in their “provider” section https://docs.goauthentik.io/add-secure-apps/providers/proxy/ . There are many guides for Authentik at least, it’s complicated but you only need to do specific things for it to work - and most tell you and the rest are applicable via matching similar looking things.
OIDC is an open login protocol many things support. I think jellyfin can use it with a plugin, but keep in mind that regular user creation still exists so it’s not a security and convenience feature like for most things, it’s just a convenience feature.
DMZ is de militarized zone. I used the acronym to mean a gap between your system and a system that deals directly with the outside Internet. That gap is the VM separation. LXC containers and docker containers do not have that separation, I deploy Internet-facing stuff in a VM as extra insurance in case they get zero-day-hacked; it means the rest of my server will hopefully not get ransomwared.
Incus is an alternative to proxmox, but less needy since it doesn’t require its own Linux kernel. Zabbly is a package source (vs built-in Debian sources) that has the web ui in it. See their documentation for installation, it tells you how to add the Zabbly package; use the “stable” version if you do use incus.
“In the compose” means in the docker-compose.yml file.
‘Cap-drop: all’ is an entry you can make in the docker-compose file. It increases security. All of the ones I listed are entries you can add to the docker-compose file. You’ll likely need a
tmpfs: /tmp
In the compose file you use read only.
Podman is the superior alternative to docker, and Podman quadlets are a way to deploy containers (they have a couple ways, like docker does - you don’t need a docker-compose.yml file to run docker containers). But it’s new and doesn’t have the community knowledge support via searching like docker does.
Hope that helps!
Thats very helpful, thank you!