you are viewing a single comment's thread
view the rest of the comments
[+] 5 points 2 months ago (2 children)
  • [–] 9 points 2 months ago (1 child)

    I put mine behind a reverse proxy, like any sane person would. Configure an original sni and you are basically invisible. (Tls1.3, doh/dot make it even better, depending on your threat model, but most likely overkill)

  • source
  • parent
  • hideshow 2 child comments
  • [–] 8 points 2 months ago (1 child)

    While you are (probably?) correct, this is significantly beyond what is required to deploy Plex for a standard home server chump like me.

    I'm using jellyfin and a few others, but am consciously putting off exposing these services to the web until I can learn enough about security to do so. Given life, this will probably take me the better part of a year...

  • source
  • parent
  • hideshow 2 child comments
  • [–] 7 points 2 months ago

    you are right to be careful here. But it certainly is also not a "requirement to deploy jellyfin" either. It's just a good practice to minimize attack surface, no matter what you expose. Unless it's meant for the general public and advertised, then this makes little sense :-)

    Also, most selfhosters have at best one IP to use. This helps with the one-IP-multiple-webservices problem anyway.

  • source
  • parent
  • [–] 4 points 2 months ago (1 child)

    I use tailscale when I'm in these situations. It even works behind the most cursed CGNAT like starlink where it's impossible to even port forward.

    As long as your tunnel is running you just use the private IP address for your jellyfin machine and your parents will access it like it's local.

  • source
  • parent
  • hideshow 2 child comments