204
How would you expose Jellyfin securely without a vpn? (discuss.online)
submitted 3 months ago by to c/selfhosted@lemmy.world
199 comments fedilink hide all child comments
 

Assuming the user will not be connecting over vpn, but is both remote and non-technical, how would you expose Jellyfin to them securely?

you are viewing a single comment's thread
view the rest of the comments
[–] 11 points 3 months ago (3 children)

Ask them to visit https://ipv4.icanhazip.com/ and give you back the number, then whitelist in your webserver, as well as your LAN/VPN range, deny rest. Explain they can only reach jellyfin from their home internet. Repeat if they get 403 forbidden after they get a new WAN IP.

That or VPN like openziti, wireguard but gets more complicated.

  • permalink
  • fedilink
  • source
  • hideshow 6 child comments
    •
  • [–] 5 points 3 months ago (1 child)

    You really can't assume your visitors are going to have static IPs.

    What happens when they visit from their phone? A friend's WiFi? Their home connection that has a regularly changing IP?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 3 months ago* (last edited 3 months ago) (1 child)

    So far I've seen WAN leases expire after a long time, say months, or quarter year, so is doable. If becomes an issue I'll work with them on a VPN solution but is a pain for non-technical users or non-supported hardware. That's also why I explain "use from your home network only".

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 3 months ago (1 child)

    What's your concern about running it behind a reverse proxy, like caddy or nginx?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •