Please take this discussion to this post: https://lemmy.ml/post/28376589
Main content
Selfhosting is always a dilemma in terms of security for a lot of reasons. Nevertheless, I have one simple goal: selfhost a Jellyfin instance in the most secure way possible. I don't plan to access it anywhere but home.
TL;DR
I want the highest degree of security possible, but my hard limits are:
- No custom DNS
- Always-on VPN
- No self-signed certificates (unless there is no risk of MITM)
- No external server
Full explanation
I want to be able to access it from multiple devices, so it can't be a local-only instance.
I have a Raspberry Pi 5 that I want to host it on. That means I will not be hosting it on an external server, and I will only be able to run something light like securecore rather than something heavy like Qubes OS. Eventually I would like to use GrapheneOS to host it, once Android's virtual machine management app becomes more stable.
It's still crazy to me that 2TB microSDXC cards are a real thing.
I would like to avoid subscription costs such as the cost of buying a domain or the cost of paying for a VPN, however I prioritize security over cost. It is truly annoying that Jellyfin clients seldom support self-signed certificates, meaning the only way to get proper E2EE is by buying a domain and using a certificate authority. I wouldn't want to use a self-signed certificate anyways, due to the risk of MITM attacks. I am a penetration tester, so I have tested attacks by injecting malicious certificates before. It is possible to add self-signed certificates as trusted certificates for each system, but I haven't been able to get that to work since it seems clients don't trust them anyways.
Buying a domain also runs many privacy risks, since it's difficult to buy domains without handing over personal information. I do not want to change my DNS, since that risks browser fingerprinting if it differs from the VPN provider. I always use a VPN (currently ProtonVPN) for my devices.
If I pay for ProtonVPN (or other providers) it is possible to allow LAN connections, which would help significantly, but the issue of self-signed certificates still lingers.
With that said, it seems my options are very limited.
This would require paying for a VPN to allow LAN connections, which is an option but not my preferred one.
This is a matter of threat model, and I would prefer not to expose my TV preferences unencrypted over the network.
Does Caddy require a custom DNS in order to point the domain to a local IP address?
This is easy with securecore, since it updates daily. The rest of the semantics for the actual hosting side aren't too difficult.
You could do a vpn hosting by yourself.
Meaning your server is basically a vpn tunnel server and you can connect from the Internet to it. Once you are in the encrypted vpn connection you have access to the local network.
If you have dynamic ip you need dns though. But no one can connect just because they know the ip)/dns
I'm uneasy about this, because I don't trust myself to do it securely. VPNs are a very complex piece of software, so I highly prefer to stick with widely used setups (i.e. "stock" VPN software such as ProtonVPN, Mullvad VPN, etc.)
A self-hosted VPN is the most secure free way to host your Jellyfin. I’ve had to learn the hard way over the years, but all the features and control you gain for hosting services yourself comes with all the same responsibilities and risk that the provider would be taking on for you.
The money you spend on their service is the alternative to the many hours it takes to learn how to properly host your own server.
You can definitely learn how to do it and it will be difficult and confusing at times, but that’s what the community is there for. I recommend joining a Matrix server or similar so you can get more real-time feedback for when you’re just getting started.
Totally understand not wanting to take the risk, though. Just something worth considering.