My old kodi setup just works, year after year, and will work 10 years from now too...
this post was submitted on 19 May 2026
253 points (96.7% liked)
Selfhosted
56957 readers
866 users here now
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.
Rules:
-
Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.
-
No spam posting.
-
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.
-
Don't duplicate the full text of your blog or github here. Just post the link for folks to click.
-
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
-
No trolling.
-
No low-effort posts. This is subjective and will largely be determined by the community member reports.
Resources:
- selfh.st Newsletter and index of selfhosted software and apps
- awesome-selfhosted software
- awesome-sysadmin resources
- Self-Hosted Podcast from Jupiter Broadcasting
Any issues on the community? Report it using the report flag.
Questions? DM the mods!
founded 3 years ago
MODERATORS
I wish jellyfin and the apps could ship with something like wireguard setup by default so people that use the jellyfin apps could instantly watch media outside their house without learning what wireguard/tailscale is
The fact that's needed at all is the problem. Developers need to stop making monolithic structures that have access to everything ever and putting it on the user to maintain to maintain a VPN network for security.
There's no reason I should not be able to just use an nginx reverse proxy for remote access to my jellyfin and have that be safe. It should at worst give people a copy of my media if there's a security issue.
Personally I went out of my way to make this be the case, i have my instance locked into an unprivileged lxc whitelist only on syscalls which took a while to figure out the minimum needed for function but I got there. The host System is using the hardened kernel from Upstream and a series of sysctl lockdowns for example P Trace is not allowed even if you are the root user.
So I do indeed just nginx reverse proxy my instant because the worst case scenario even if they got complete shell access to the system they would be locked into an unprivileged container that had no access to any files other than my media files but the fact that I have to go to this level is already ridiculous
It should at worst give people a copy of my media if there's a security issue.
that's not the worst possibility. the worst possibility is an RCE into your server.
Personally I went out of my way to make this be the case, i have my instance locked into an unprivileged lxc whitelist only on syscalls which took a while to figure out the minimum needed for function but
that's a pretty exotic setup. Exciting, but for most people learning to manage a VPN is easier
It should at worst give people a copy of my media if there's a security issue.
that's not the worst possibility. the worst possibility is an RCE into your server.
Personally I went out of my way to make this be the case, i have my instance locked into an unprivileged lxc whitelist only on syscalls which took a while to figure out the minimum needed for function but
that's a pretty exotic setup. Exciting, but for most people learning to manage a VPN is easier
I am aware that an rce is the worst possibility I'm saying it shouldn't be. The web portion is already its own isolated binary that you have to install but it's designed with seemingly very little attention to security.
To the point that jellyfin has already had several major RCE and despite having full support for running over the web with http developers are basically just like you should not be using this without a VPN which is overall a pretty pathetic stance for a media server
there are a lot of us still on Plex that hadn't reached the threshold of issues vs effort that would motivate us to migrate to something like jellyfin.
looks like we've arrived.
I have the lifetime pass, bought it for like $80 many moons ago.
looks like we’ve arrived.
Agreed, this is the tipping point. This is where we will see Plex start to abandon the lifetime pass in favor of "imaginary money line go up forever" subscriptions.
I already have a lifetime Plex pass so this isn't an issue for me. 6 months from now when Plex decides my lifetime pass has a new expiry, then I'll be motivated.
this exactly. I got a lifetime pass in the before times (pre-pandemic) back when they were $100 bucks ish, but I know it's only a matter of time before they come for us grandfathered-in fools.
Jellyfin isn't great, but it sure doesn't have this problem.
Enshittification in action.
Just to say: MythTv is still a thing...
Ahh, memories. The start of my Linux journey nearly 20 years ago
Never used Plex. Jellyfin has always met my needs, so I never bothered to try it.
Plex has been around quite a while longer than JF. Before JF, the only way to really have a "self-hosted Netflix" was with Plex, so there are a lot of us who built our long-standing media setups around that.
That said, I have a JF instance running and matched almost 1:1 with Plex specifically for this situation, so I'm going to start pivoting everyone to that as I wind Plex down.
view more: next ›