Comment by random_human_

8 hours ago

For whatever reason people here and on Reddit will tell you that you need to have Jellyfin pass through five VPNs, otherwise nasty things will happen. Meanwhile the actual devs suggests simply setting up a reverse proxy, which you can do in two lines with Caddy: https://jellyfin.org/docs/general/post-install/networking/re...

10 comments

random_human_

Reply
MaxikCZ  8 hours ago

Reverse proxy itself will do barely any defense, what you need in combination is an authgate (authentik, authelia), and here we are moving from "simple reverse proxy" to fun weekend activity and then some getting it to work as expected. + it kills the app auth flow, so only web interface is suitable for this.

  • bjackman  2 hours ago

    You can use a reverse proxy and still have working app auth, I have set this up via Authelia with the OIDC Jellyfin plugin.

    However:

    - This is EVEN MORE complex than "just" a reverse proxy.

    - I'm not really sure it wins much security, because...

    - at least I'm not relying on Jellyfin's built-in auth but I'm now relying on its/the plugin's OIDC implementation to not be completely broken.

    - attackers can still access unauthenticated endpoints.

    Overall I really wish I could just do dumb proxy auth which would solve all these issues. But I dunno how that would work with authing from random clients like Wii (and more importantly for me, WebOS).