Selfhosted

59955 readers

379 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.
No spam.
Posts here are to be centered around self-hosting. Please ensure it is clear in your post how it relates to self-hosting.
Don't duplicate the full text of your blog or git here. Just post the link for folks to click.
Submission headline should match the article title.
No trolling.

Resources:

selfh.st Newsletter and index of selfhosted software and apps
awesome-selfhosted software
awesome-sysadmin resources
Self-Hosted Podcast from Jupiter Broadcasting

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 3 years ago

MODERATORS

curbstickle@anarchist.nexus

curbstickle_lw@lemmy.world

214

How to secure Jellyfin hosted over the internet? (programming.dev)

submitted 1 year ago by lambda@programming.dev to c/selfhosted@lemmy.world

137 comments fedilink hide all child comments

I already host multiple services via caddy as my reverse proxy. Jellyfin, I am worried about authentication. How do you secure it?

you are viewing a single comment's thread
view the rest of the comments

[–] doeknius_gloek@discuss.tchncs.de 35 points 1 year ago* (last edited 1 year ago) (4 children)

No, it isn't.

EDIT: I quickly want to add that Jellyfin is still great software. Just please don't expose it to the public web, use a VPN (Wireguard, Tailscale, Nebula, ...) instead.

[–] Flipper@feddit.org 8 points 1 year ago (1 children)

Some of these are bonkers. The argument not to fix them because of backwards compatibility is even wilder. Which normal client would need the ability to get data for any other account that it hasn't the Auth token for.

[–] sugar_in_your_tea@sh.itjust.works 3 points 1 year ago (1 children)

Just make a different API prefix that's secure and subject to change, and once the official clients are updated, deprecate the insecure API (off by default).

That way you preserve backwards compatibility without forcing everyone to be insecure.

[–] merthyr1831@lemmy.ml 4 points 1 year ago

Even just basic API versioning would be sufficient. .NET offers a bunch of ways to handle breaking changes in APIs

[–] Mubelotix@jlai.lu 6 points 1 year ago

Wtf. Thank you

[–] LiveLM@lemmy.zip 5 points 1 year ago (1 children)

Oh boy. Nope. My friends gonna have to fiddle with a VPN, forget exposing JF to the outside...

[–] rice@lemmy.org 1 points 1 year ago

wireguard honestly takes like 30 seconds to do once you learn how to use it.

[–] rice@lemmy.org 0 points 1 year ago

I wouldn't say "great" it's ok software. Not even due to all of those security things which is a nightmare too. They do things like break the search speed months ago and not have any idea why, it's so insanely slow and on top of that it somehow lags the entire client when searching too, not just the server which is the only thing doing the query. Lots of issues just with that.