Selfhosted
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.
Rules:
-
Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.
-
No spam posting.
-
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.
-
Don't duplicate the full text of your blog or github here. Just post the link for folks to click.
-
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
-
No trolling.
Resources:
- selfh.st Newsletter and index of selfhosted software and apps
- awesome-selfhosted software
- awesome-sysadmin resources
- Self-Hosted Podcast from Jupiter Broadcasting
Any issues on the community? Report it using the report flag.
Questions? DM the mods!
view the rest of the comments
How do you do this on Jellyfin? The only ways I'm familiar with is to expose Jellyfin to the internet or access it through Tailscale, would love to hear alternatives.
Edit: From the replies I think that either I don't understand how this feature works or many people here don't, so I'll give an overview of my understanding and explain why this is different from anything you can do on Jellyfin and what's the closest you can come.
You are running Plex-home in your house, Plex-home connects to Plex-server hosted by Plex and establishes a reverse connection that's only accessible by Plex-server, i.e. you can't access your Plex-home outside of your house. When you login on Plex you're logging in to Plex-server and if you're in the same network as Plex-home you get redirected to form a direct connection with it, if not (and for me Plex keeps failing this verification) you connect to Plex-server and every request you make gets forwarded to Plex-home and when you ask for media it gets routed through Plex-server. This is very different from exposing Plex-home directly to the internet, in order for someone online to access your Plex-home they need to have taken control of Plex-server and then they're limited by the API between those two (whichight be different from the Plex-home API) to try to escalate into your machine.
With Jellyfin there's no server side component, you access Jellyfin directly every time, so in order to access Jellyfin outside of your house it needs to be accessible for everyone. The closest you can come up with is using a third party authentication server, for example by having a VPS running Authentik/Authelia/etc and hosting Jellyfin behind that authentication. This gets you a similar level of security because someone would need to compromise your Auth and then your Jellyfin to get into your server. However I'm not sure Jellyfin clients would know how to handle a third party authentication service, and would probably just crap their pants and prevent you from logging in. You could still access it in a browser, but not on native clients like the one on your TV or Fire Stick.
If you don't have this VPS with authentication you're exposing Jellyfin directly to the internet, which means that any flaw in Jellyfin security immediately compromises your home server. And while I don't expect there to be many big or obvious flaws, there's a reason why stuff like Authelia or Authentik exists, and besides the convenience of a SSO they exist because proper authentication is hard and has many pitfalls, and they offer security in the knowledge that their main focus is authentication, whereas on most other services authentication is just one of the features they offer so it might not be as secure.
My home connection is behind cgnat so I got a free VPS from oracle (provides a public ip address), install caddy on VPS, install tailscale on VPS and router, expose routes from LAN to tailscale network.
Now you can use caddy to expose, for example, a docker container (jellyfin) at 192.168.1.100 to subdomain.exampledomain.com with ssl cert provided by caddy.
VPS also requires some other stuff like ddclient and fail2ban.
I pieced this all together myself... it's doable if you spend some time reading.
That exposes Jellyfin to the internet
Yes exactly. What do you think plex is doing?
Using a relay server to separate online from home connection
I don't see anything in the linked article about a relay server
No, the article only mentions the feature by name, the docs for the feature mentions the relay https://support.plex.tv/articles/216766168-accessing-a-server-through-relay/
I see. So if you read that instruction you'll see it's the exact same setup that I outlined. They use a vpn to connect your client to your server and just negotiate the meeting in the middle. It's the exact same risk scenario as running a reverse proxy on your own vps. Unless I'm missing something else?
You are, authentication on the VPS, you're relying on Jellyfin authentication against the internet. Correct me if I'm wrong, but this is your suggested setup: [home server] Jellyfin -> [remote server] Reverse Proxy -> [remote machine] users. Let's imagine a scenario where Jellyfin has a bug that if you leave the password empty it logs you in (I know, it's an exaggeration but just for the sake of argument, an SQL injection or other similar attacks would be more plausible but I'm trying to keep things simple), on your setup now anyone can log into your Jellyfin and from there it's one jump to your home server. On Plex's solution even if Plex authentication gets compromised the attacker only got access to the remote server, and would now need to find another vulnerability to jump to your Plex at home.
Putting something like Authelia/Authentik on a VPS in front of Jellyfin is a similar approach, but the Jellyfin client can't handle third party authentication AFAIK
My interpretation of your linked instruction (granted, I haven't tried plex) is that it's the same two scenarios.
Your plex client app login talks directly to your server login. The client app meeting the server is arranged by the plex relay server and nothing more. There is no 'logging in' to the plex relay server; it's function is to arrange a meeting of two tunnels and that's it, much like a tailscale derp server.
The relay server is serving the same function as caddy on a VPS, hell, they could even be using tailscale under the hood and it'd look exactly the same to a user.
Anyway, attack vectors even with a public facing jellyfin are mitigated because
a) jellyfin is running in a docker container = a successful attacker would only be able to trash my jellyfin container, which ultimately is not that big of a deal (unless there is a different docker exploit that enables access to the server itself, which is an entirely different issue and larger than a jellyfin/plex discussion)
b) fail2ban in conjunction with a reverse proxy bans malicious ip addresses that come back with too many errors too many times (errors that you, the admin, specify) So, for example, brute force login attacks are mitigated.
c) the reverse proxy itself allows access to only one specified internal ip address/port combination. Pending a caddy exploit (again, a different discussion) it is not possible to fish for acrive ip addresses or port scan my internal network.
First of all I agree with most of your a, b and c points, just would like to point out that while it's true that Docker containers provide an extra level of security they're not as closed down as people sometimes believe, but as a general rule I agree with everything you said.
But you're wrong about the way Plex works, this is a quote from their documentation:
If that's not clear enough:
So it's very clear data is streaming through their relay server, which goes back to my original point of I expect that to be a paid feature, it's using bandwidth from their relay servers.
As for the security again you're wrong, authentication happens on the Plex remote server, not on your local one, which is why you can't use Plex without internet (part of my dislike for them). So you connect to Plex remote server and authenticate there, you then get a client that's talking to the remote server, even if someone was able to bypass that login they would be inside a Plex owned server, not yours, they would need to then exploit whatever API exists between your home server and that one to jump to your machine, so it's an extra jump needed, again similarly to having Authelia/Authentik in front of Jellyfin.
Reverse proxy
That exposes Jellyfin to the internet, so it's my option 1.
It's not that hard to get a reverse proxy up, get a free DDNS, and a SSL certificate from let's encrypt.
https://www.linuxserver.io/blog/2020-08-21-introducing-swag
This is a pretty solid one stop shop for handling all reverse proxy with SSL certificate generation and renewal for jellyfin and other applications like sonarr, radarr, transmission, ombi and lists of others that are pretty much drag and drop configuration files if you're not mucking with the application's default ports.
That exposes Jellyfin to the internet, so it's not the same feature
And somehow you think that Plex isn't exposing your server to the Internet for streaming while not on your local network?
Okay there Mr. Madison.
It's not, not directly at least, and that's what everyone is ignoring here. You probably understand the value on Authelia/Authentik but you're failing to see that the Plex relay server is taking that same mantle here, so even if someone managed to compromise the relay server it's still not on your home server, whereas exposing jellyfin directly to the internet only requires one service to be compromised.
My dude if you are connecting from outside your local network you are "exposed" to the Internet in some way. What magic are you thinking Plex is doing? Is someone hand deliverying the packets via USPS?
In some way is different from directly, on Plex you're behind a relay server so it's akin to being behind a VPS running Authentik/Authelia in front of the service on your home. Compromising the relay server does not necessarily compromises your home server, so it's not direct like putting Jellyfin on a reverse Proxy would be.
Plex runs relay servers where your Plex server will connect to the relay and your player will also connect to the relay, making both ends of the connection egress type as far as routing and access control goes. https://support.plex.tv/articles/216766168-accessing-a-server-through-relay/
It's optional and likely not everyone uses it, but this provides a way for Plex to do remote streaming without the Plex server being reachable directly from the internet.
Separately, it costs money for Plex to run.