▲ 204 ▼ How would you expose Jellyfin securely without a vpn? (discuss.online) submitted 4 months ago by kiol@discuss.online to c/selfhosted@lemmy.world 199 comments fedilink hide all child comments Assuming the user will not be connecting over vpn, but is both remote and non-technical, how would you expose Jellyfin to them securely?
[–] anon_8675309@lemmy.world 1 point 4 months ago (4 children) Okay then use a vpn. permalink fedilink source parent hideshow 4 child comments replies: [–] BakedCatboy@lemmy.ml 2 points 4 months ago (2 children) That's exactly the point I'm getting at. Putting an auth wall doesn't work with many apps, and if you add exceptions to the API then you're not really protecting anything. permalink fedilink source parent hideshow 2 child comments replies: [–] pushpull@fosstodon.org 1 point 4 months ago* (1 child) @BakedCatboy @anon_8675309 I think that could be fixed with authentication through headers (netbird reverse proxy supports that, no idea about pangolin though) but apps should also support adding custom headers on requests permalink fedilink source parent hideshow 1 child comment replies: [–] BakedCatboy@lemmy.ml 3 points 4 months ago Yes that's what I would like to advocate for. I did something similar with LunaSea, but often people suggest doing that with Jellyfin and are not aware that almost no apps support it, and that adding exceptions for the API makes you basically as secure as not having it. But people tend to get very defensive when you try to tell them that something won't work, so I try to phrase it as a question to see if I can get them to understand what the limitations are in a way that's less confrontational. permalink fedilink source parent [+] pushpull@fosstodon.org 0 points 4 months ago [deleted] permalink fedilink source parent
[–] BakedCatboy@lemmy.ml 2 points 4 months ago (2 children) That's exactly the point I'm getting at. Putting an auth wall doesn't work with many apps, and if you add exceptions to the API then you're not really protecting anything. permalink fedilink source parent hideshow 2 child comments replies: [–] pushpull@fosstodon.org 1 point 4 months ago* (1 child) @BakedCatboy @anon_8675309 I think that could be fixed with authentication through headers (netbird reverse proxy supports that, no idea about pangolin though) but apps should also support adding custom headers on requests permalink fedilink source parent hideshow 1 child comment replies: [–] BakedCatboy@lemmy.ml 3 points 4 months ago Yes that's what I would like to advocate for. I did something similar with LunaSea, but often people suggest doing that with Jellyfin and are not aware that almost no apps support it, and that adding exceptions for the API makes you basically as secure as not having it. But people tend to get very defensive when you try to tell them that something won't work, so I try to phrase it as a question to see if I can get them to understand what the limitations are in a way that's less confrontational. permalink fedilink source parent
[–] pushpull@fosstodon.org 1 point 4 months ago* (1 child) @BakedCatboy @anon_8675309 I think that could be fixed with authentication through headers (netbird reverse proxy supports that, no idea about pangolin though) but apps should also support adding custom headers on requests permalink fedilink source parent hideshow 1 child comment replies: [–] BakedCatboy@lemmy.ml 3 points 4 months ago Yes that's what I would like to advocate for. I did something similar with LunaSea, but often people suggest doing that with Jellyfin and are not aware that almost no apps support it, and that adding exceptions for the API makes you basically as secure as not having it. But people tend to get very defensive when you try to tell them that something won't work, so I try to phrase it as a question to see if I can get them to understand what the limitations are in a way that's less confrontational. permalink fedilink source parent
[–] BakedCatboy@lemmy.ml 3 points 4 months ago Yes that's what I would like to advocate for. I did something similar with LunaSea, but often people suggest doing that with Jellyfin and are not aware that almost no apps support it, and that adding exceptions for the API makes you basically as secure as not having it. But people tend to get very defensive when you try to tell them that something won't work, so I try to phrase it as a question to see if I can get them to understand what the limitations are in a way that's less confrontational. permalink fedilink source parent