I think people over blow how dangerous it is. Or maybe its better most people dont. I don’t know I know the issues and I take measures to mitigate them. Then if someone gets in they would be limited to vlan. And if somebody gets out of that good wasted so much effort for nothing since I have nothing that would be worth that much trouble.
And before someone says identity pretty sire that has been in so many other leaks overt the years the information is pretty old.
Read-only, rootless container with only the cache/transcode/config folders mounted RW+noexec - ideally both with a volume size limit.
Reverse proxy only the absolutely minimal ports needed, with some security measures (e.g. crowdsec transparent proxy, hooked up to both your firewall and reverse proxy to block malicious actors.
The start of this thread is “number one reason people don’t move to Jellyfin is ease of remote access.”
30 years ago I was compiling slackware and configuring dns servers, and setting up BGP on Ciscos. But a few hours of attempting to setup Jellyfin was a failure. It was far more complex than setting up dns/bind.
Not at Cisco. With a Cisco. I ran a mid sized ISP in the 90’s until I was bought out by a cable company and retired. Although several of my employees went on to work at Cisco. I also had a few friends who were executives at Cisco because we all started at a company working for Vint Cerf and Bob Khan (they were the angel investors) back before most knew of the Internet.
First it’s a VM because I’m not going mess around with stuff on bare metal. Create docker is a can of worms because you have to pick a reverse proxy software like nginx, traefik, caddy. Which means you need to understand all three to know which to pick. Then there’s setting up the certificate with the dns provider. So I got nginx working with a certificate but gave up after the VM running Jellyfin couldn’t see it. Googling showed someone on Reddit with the same problem but no answer other than others saying “works for me”
First it’s a VM because I’m not going mess around with stuff on bare metal.
Containerisation method doesn’t matter, the point is to have an untrusted container (VM, thin container, LXC, whatever) that a process cannot exit, has no root user rights, and can be limited externally for what resources it sees.
The entire point is to be able to say “here’s your config folder where you can write shit, but not execute; here’s the data folder where you can neither write or execute shit; and here’s the read-only executable layer of the image/VM/container”.
Create docker is a can of worms because you have to pick a reverse proxy software like nginx, traefik, caddy. Which means you need to understand all three to know which to pick.
Regardless how you’re hosting it, a reverse proxy is necessary. Even with a VM.
Here’s a fun fact: Caddy and Traefik both come with ways to easily configure all the necessary things via Docker container labels. I need about 3-4 labels per container to set up the subdomain I need, the port I want to forward to it, and the security level (auth, crowdsec, etc.)
Then there’s setting up the certificate with the dns provider.
Uh what? ACME makes it a literal one line configuration. Two if you include the DNS host scoped token.
So I got nginx working with a certificate but gave up after the VM running Jellyfin couldn’t see it. Googling showed someone on Reddit with the same problem but no answer other than others saying “works for me”.
So the problem wasn’t Jellyfin but you not being able to follow a dead simple guide. And to think you were running a whole ass ISP…
Jellyfin but you not being able to follow a dead simple guide.
The fact that others had the same problem without solution means it isn’t follow a dead simple guide. There are multiple guides. Just setting up docker means you have to already know to not use it and run podman. Because if you follow the online guides on docker’s own website, you end up with a docker gui and their AI assistant installed.
And to think you were running a whole ass ISP…
You are arguing that setting up an Internet server is as simple as it was 30 years ago. You are arguing for the sake of arguing.
Beside, that wasn’t even the topic. We were discussing - or rather, I was proving to the above commenter - that setting up Jellyfin in a way that does not allow an intruder to crypto mine or host CSAM or use your device as a proxy, is incredibly easy.
Port setup and it’s perceived impossibility by you has naught to do with that topic.
Just throw a wireguard tunnel on your router and call it a day.
If ya gotta host public put a dedicated proxmox host on its own port on your router, make it a trunk line, and give every VM its own subnet/VLAN/Firewall ruleset.
That’s pretty much the number one reason people say they won’t move to Jellyfin - the ease of public access.
Even though exposing your shit to Internet is a terrible idea for most people.
I think people over blow how dangerous it is. Or maybe its better most people dont. I don’t know I know the issues and I take measures to mitigate them. Then if someone gets in they would be limited to vlan. And if somebody gets out of that good wasted so much effort for nothing since I have nothing that would be worth that much trouble.
And before someone says identity pretty sire that has been in so many other leaks overt the years the information is pretty old.
Even without data compromise or pivoting, they can still mine crypto on your hardware, launch a ddos, spam email, do botnet stuff, or host CSAM.
Not if your Jellyfin is set up correctly.
Read-only, rootless container with only the cache/transcode/config folders mounted RW+noexec - ideally both with a volume size limit.
Reverse proxy only the absolutely minimal ports needed, with some security measures (e.g. crowdsec transparent proxy, hooked up to both your firewall and reverse proxy to block malicious actors.
The start of this thread is “number one reason people don’t move to Jellyfin is ease of remote access.”
30 years ago I was compiling slackware and configuring dns servers, and setting up BGP on Ciscos. But a few hours of attempting to setup Jellyfin was a failure. It was far more complex than setting up dns/bind.
It’s literally just:
I highly doubt that if somehow you were setting up BGPs at Cisco, this incredibly straightforward port setup somehow got the best of you.
Not at Cisco. With a Cisco. I ran a mid sized ISP in the 90’s until I was bought out by a cable company and retired. Although several of my employees went on to work at Cisco. I also had a few friends who were executives at Cisco because we all started at a company working for Vint Cerf and Bob Khan (they were the angel investors) back before most knew of the Internet.
First it’s a VM because I’m not going mess around with stuff on bare metal. Create docker is a can of worms because you have to pick a reverse proxy software like nginx, traefik, caddy. Which means you need to understand all three to know which to pick. Then there’s setting up the certificate with the dns provider. So I got nginx working with a certificate but gave up after the VM running Jellyfin couldn’t see it. Googling showed someone on Reddit with the same problem but no answer other than others saying “works for me”
Containerisation method doesn’t matter, the point is to have an untrusted container (VM, thin container, LXC, whatever) that a process cannot exit, has no root user rights, and can be limited externally for what resources it sees.
The entire point is to be able to say “here’s your config folder where you can write shit, but not execute; here’s the data folder where you can neither write or execute shit; and here’s the read-only executable layer of the image/VM/container”.
Regardless how you’re hosting it, a reverse proxy is necessary. Even with a VM.
Here’s a fun fact: Caddy and Traefik both come with ways to easily configure all the necessary things via Docker container labels. I need about 3-4 labels per container to set up the subdomain I need, the port I want to forward to it, and the security level (auth, crowdsec, etc.)
Uh what? ACME makes it a literal one line configuration. Two if you include the DNS host scoped token.
So the problem wasn’t Jellyfin but you not being able to follow a dead simple guide. And to think you were running a whole ass ISP…
The fact that others had the same problem without solution means it isn’t follow a dead simple guide. There are multiple guides. Just setting up docker means you have to already know to not use it and run podman. Because if you follow the online guides on docker’s own website, you end up with a docker gui and their AI assistant installed.
You are arguing that setting up an Internet server is as simple as it was 30 years ago. You are arguing for the sake of arguing.
Beside, that wasn’t even the topic. We were discussing - or rather, I was proving to the above commenter - that setting up Jellyfin in a way that does not allow an intruder to crypto mine or host CSAM or use your device as a proxy, is incredibly easy.
Port setup and it’s perceived impossibility by you has naught to do with that topic.
Just throw a wireguard tunnel on your router and call it a day.
If ya gotta host public put a dedicated proxmox host on its own port on your router, make it a trunk line, and give every VM its own subnet/VLAN/Firewall ruleset.
That’s fine for your personal remote access but that doesn’t help your 80 year old mother in law watch videos of the grandchildren on a Roku.
Been thinking of throwing together a set top box with everything made up for my grandfather so he can stream stuff from my jellyfin setup.
I just need to find an ezpz enough to use frontend.
Slap a vpn on her computer or but a shitty dell from good will. Point the Roku at that and forward the traffic…?
Like this is a solvable setup and forget about it for the next 5 years. Sort of set up.
WG works for us, but isn’t scalable once it comes to sharing. It would provide too much friction for a lot of people
It’s really not. If people are too lazy to install one VPN app and import the tunnel config, then they can pay for paid streaming instead.
I manage it with netbird.
Just have em install netbird, if it’s on they can connect to my website. If it’s off they can’t.
It’s literally three steps for each person, there’s ways to make this easy. It just requires the host to put in the leg work
I’ll check it out! Thanks for the recommendation