Assuming the user will not be connecting over vpn, but is both remote and non-technical, how would you expose Jellyfin to them securely?

  • kcweller@feddit.nlEnglish
    1·
    5 hours ago

    Set up a reverse proxy with https always on. And get a good (physical) firewall, preferably something akin to opnsense, pfsense, openwrt. Exposing is always a risk, and if you do want it, you have to bear the responsibility for your own security. Keep things up to date, set up monitoring and a good logging system (Wazuh) comes to mind.

    Exposure means a security risk. How you deal with that security risk is your choice.

    Cloudflare and the likes forbid usage of their stuff for these things.

    • syaochan@feddit.itEnglish
      1·
      4 hours ago

      How does a reverse proxy helps for security? I mean, the problem here is that exposing Jellyfin on the internet is dangerous: the only way to improve security via a reverse proxy would be mTLS, but I’m not sure how it would work client side.

      • Flatfire@lemmy.caEnglish
        1·
        46 minutes ago

        You’ve got a couple benefits. If you have a domain name, and aren’t advertising it publicly, then you can use the reverse proxy to point that domain to a non-standard port that Jellyfin runs on.

        Security through obscurity is not good security, but it does prevent the majority of port scanning attacks. You can also use fail2ban on the reverse proxy side to try and mitigate some attacks.