I already host multiple services via caddy as my reverse proxy. Jellyfin, I am worried about authentication. How do you secure it?

  • @[email protected]
    link
    fedilink
    English
    34
    edit-2
    28 days ago

    My setup: Locally (all in docker):

    • JF for managing and local access
    • JF with read only mounted volumes that uses the network of my Wireguard client container
    • Wireguard client opening a tunnel to Wireguard server on VPS ** Ping container regularly doing pings to Wireguard Server so the connection stays up (didn’t manage it otherwise)

    VPS (Oracle Cloud free tier, also everything in docker):

    • Caddy as a reverse proxy with https enabled and geolocking (only certain countries are allowed to connect to)
    • fail2ban to block IPs that try to bruteforce credentials
    • Wireguard server

    Usernames are not shown in the frontend and have to be entered. Passwords are generated by a password manager and can’t be changed by the user.

    So my clients just get the URL of my reverse proxy and can access the read only JF through my Wireguard tunnel. Didn’t have to open any ports on my side. If someone is interested I can share the docker compose files later.

    Edit: Here the link to the setup description. Please tell me if something is not clear or you find an error. https://codeberg.org/skjalli/jellyfin-vps-setup

        • @[email protected]
          link
          fedilink
          English
          227 days ago

          This is honestly awesome! I was thinking about a similar setup for a long time but wasn’t sure how to do this exactly, this seems exactly like the setup I was looking for. Thank you!

          • @[email protected]
            link
            fedilink
            English
            227 days ago

            You’re welcome, happy that I can help. I also just updated it a bit. In case you find any issues or have questions please let me know. It was mostly trial and error until it ran…

    • λλλOP
      link
      fedilink
      English
      228 days ago

      I’m more interested in the fail2ban setup. How did you do that for Jellyfin? Is it through a plugin?

    • @[email protected]
      link
      fedilink
      English
      128 days ago

      This seems like a developer/infrastructure level job, any dumb down step by step procedure to recommend?

      • @[email protected]
        link
        fedilink
        English
        528 days ago

        I am currently in the ptocess to document my docker fioes and upload them to codeberg with a readme, it takes a bit, will let you know once I am done

          • @[email protected]
            link
            fedilink
            English
            228 days ago

            It’s a steep learning curve for sure but once you get the basics it’s straight forward until you hit very specific problems.

            Are you a Windows or Linux user? They often want to push their Docker UI application but in my opinion docker engine with docker compose is enough. There are probably a lot of great tutorials out there and I can recommend https://www.linuxserver.io/ for images.