204
How would you expose Jellyfin securely without a vpn? (discuss.online)
submitted 3 months ago by to c/selfhosted@lemmy.world
200 comments fedilink hide all child comments
 

Assuming the user will not be connecting over vpn, but is both remote and non-technical, how would you expose Jellyfin to them securely?

you are viewing a single comment's thread
view the rest of the comments
[–] 5 points 2 months ago (1 child)

I recently did exactly this. Only works with the web UI, no apps support it, but working well and those without the cert just get a 400 error. Not sure if non technical tbh, since you will get warnings when adding your root certificates to any device, and that might scare some who don't understand what it does.

Also set it up through wireguard, so can punch out of double NAT.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 2 months ago (1 child)

    Only works with the web UI, no apps support it

    Yeah that's true.

    you will get warnings when adding your root certificates to any device

    It's not a root certificate, and I've never seen any warnings.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 2 months ago (1 child)

    You need the web site to use a certificate from the same root authority as your client certificate. Otherwise browsers won't present the certificate to the server. That means either warnings on connect or adding the root cert.

    I do think if you are doing it with them in person it is doable to add it.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 2 months ago

    You need the web site to use a certificate from the same root authority as your client certificate.

    I'm not sure if I've misunderstood you, but I use Lets Encrypt for the server's TLS, and then my own CA cert (which is only present on the webserver) for the client's mTLS and everything works fine, since it's the client that validates the server's cert and the server that validates the client's cert.

  • permalink
  • fedilink
  • source
  • parent