← Back to context

Comment by falkensmaize

9 hours ago

Plex in particular is notoriously insecure. It should never be accessible to the open internet unless via a vpn like WireGuard. Just playing with fire otherwise.

12 comments

falkensmaize

Reply
DaSHacka  8 hours ago

That may be true, but how do you grant non-technical family/friends access? They don't even understand what a VPN is, let alone how to toggle one on/off to access the Jellyfin instance.

Additionally, if they try to connect from an Android TV / Fire Stick, where you can't configure a VPN (and use their ISP's modem, so no wireguard client on the router to transparently route to the subnet), what are you supposed to do?

I feel it may be easier long-term to just contain the Jellyfin daemon to only r/o access to media, putting it behind a subdomain like jellyfin.example.com, and use the dns-01 challenge via LE to only provision a wildcard cert for the domain (IE *.example.com).

Then, have nginx listen on 80/443 with a default server directive that returns 444 for any requests not to the (correct) jellyfin hostname (due to bots hammering 80/443 across the internet on webserver's direct IPs).

Its the only solution I can think of to make it easy for nontechnical users (everything just described is completely invisible to a regular client) while reducing the attack surface area of the daemon.

FWIW, with the aforementioned setup, I got 0 unauthorized requests to my jellyfin server. Just a bunch of bots hammering my IP's 80/443 ports directly with exploits for old (usually wordpress) vulns, but they were all served 444 (IE an immediate TCP connection close without nginx even responding to the request).

  • clundin22  3 minutes ago

    I use a raspberry pi and nginx to forward my jellyfin over Tailscale. This works really well, Tailscale is low touch and nginx is battletested. Jellyfin appears as a local service to other devices and I manage the raspberry pi with NixOS which makes the setup easy and deployable. Just plug in the pre imaged raspberry pi.

  • thejazzman  2 hours ago

    I was on this same line of thinking a few months ago when I made the mistake of switching to T-Mobile Home Internet and discovered I'd been CGNAT'd

    Every time I want to share with someone I have to stop and debate if I want to possibly have to drive over to their house etc.

    So here's my attempt at solving the problem: https://pixelbrite.site/en/profiles

  • yegle  8 hours ago

    Tailscale is easy to explain.

    "Install this app on your Apple TV or Android TV, login with your Gmail, and let me know your email address."

    • financetechbro  7 hours ago

      Yes I’ve successfully explained Tailscale to anyone that has had a corporate job and has experience having to log into a work computer VPN before accessing their work intranet

      1 reply →

eddythompson80  8 hours ago

Almost all selfhosted services are in that bucket now. Everything from Plex, Jellyfin, to nextcloud or gitea/forgejo. Few months ago I went through all my setup and moved everything to a vpn. The only service I kept public is a static directory served by nginx where I keep some html food recipes I shared with a friend before.

It's less convenient to use and pretty much impossible to share with others. I can figure out a VPN on all my devices for the most part (except for a Boox ereader). Trying to get "family and friends" to install and maintain a VPN on their devices to be able to access services I share with them is a pipe dream.

wolrah  8 hours ago

Did you miss the point about working on random devices? That's the key to why I use Plex at all. If I have to install and set up a VPN client on it I'd just use Jellyfin because at that point I've limited myself to only my devices.

Also of course friends/family. The most technologically useless people I know can operate Plex and can access my collection with basically no support necessary.