this post was submitted on 23 May 2026
190 points (97.0% liked)

Selfhosted

61307 readers
211 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

Detailed Rules Post

  1. Be civil.

  2. No spam.

  3. Posts are to be related to self-hosting.

  4. Don't duplicate the full text of your blog or readme if you're providing a link.

  5. Submission headline should match the article title.

  6. No trolling.

  7. Promotion posts require active participation, with an account that is at least 30 days old. F/LOSS without a paywall has exceptions, with requirements. See the rules link for details. Tags [CBH] or [AIP] are required, see the links in Rule 8 for details.

  8. AI-related discussions and AI-involved promotional posts have additional requirements for tagging, as noted in Rule 7 and the AI & Promotional Post Expanded Rules post, and find example disclosures here.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 3 years ago
MODERATORS
 

Assuming the user will not be connecting over vpn, but is both remote and non-technical, how would you expose Jellyfin to them securely?

you are viewing a single comment's thread
view the rest of the comments
[–] Nibodhika@lemmy.world 19 points 2 months ago (2 children)

Secure is relative, you should be aware that jellyfin itself has security issues https://github.com/jellyfin/jellyfin/issues/5415 most of which are harmless, but at least one is fairly serious and allows people to watch your media without authentication, and adding an extra layer of authentication on the proxy would likely cause issues with clients.

That being said, if you're okay with those security issues what I would do is have a cheap VPS, connect both machines to tailscale, and have something like Caddy on the VPS to do the forwarding.

[–] exu@feditown.com 35 points 2 months ago (3 children)

Just leaving this here

Now, let's address this clearly once and for all. What is possible is unauthenticated streaming. Each item in a Jellyfin library has a UUID generated which is based on a checksum of the file path. So, theoretically, if someone knows your exact media paths, they could calculate the item IDs, and then use that ItemID to initiate an unauthenticated stream of the media. As far as we know this has never actually been seen in the wild. This does not affect anything else - all other configuration/management endpoints are behind user authentication. Is this suboptimal? Yes. Is this a massive red-flag security risk that actively exposes your data to the Internet? No.

https://github.com/jellyfin/jellyfin/issues/5415#issuecomment-2825240290

[–] Appoxo@lemmy.dbzer0.com 11 points 2 months ago

It really seems overblown of an issue...

[–] Nibodhika@lemmy.world 6 points 2 months ago

Except most people have almost the same structure because of media organizers like radarr/sonarr. At the very least they should hide that behind a setting to not require auth (since the header should be there for most clients) so only people running an old client would be affected. They could also add an extra salt to that hash or something similar.

I agree, it's not critical, but it shouldn't be hand waved either. And like I said, security is relative, I would argue for most people this is fine, but I still think this should be taken more seriously.

[–] FreedomAdvocate@lemmy.net.au -3 points 2 months ago (1 children)

Isn’t it hilarious that the best solution to do remote streaming using the free software that people use because they don’t want to pay for a Plex subscription or one-off cost is to pay for at least one subscription, maybe more?

It’s almost like the reason Plex charge money is because it’s not free to do.

[–] Nibodhika@lemmy.world 2 points 2 months ago (1 children)

What Plex does is closer to having an embedded tailscale client, you can access Jellyfin remotely with tailscale for free, but OP specifically asked for no VPN.

That being said, I'm not opposed to Plex charging for that service, even a tailscale like server costs something to maintain. My gripe with Plex is that it purposefully shoots itself in the foot to force you into their paid service, i.e. it actively tries to isolate itself so you can't access it remotely, which means that it can't run inside a docker container unless you give it network host access, otherwise it only considers other docker containers locals and doesn't let you watch your own content from another machine in the same network.

[–] FreedomAdvocate@lemmy.net.au 0 points 2 months ago (1 children)

There’s zero need to run Plex in a docker container.

[–] Nibodhika@lemmy.world 0 points 2 months ago (1 children)

There's zero need to run anything in docker, it just makes things easier and portable.

[–] FreedomAdvocate@lemmy.net.au -1 points 2 months ago* (last edited 2 months ago) (1 children)

Plex server doesn’t need to be “portable”, and running it in docker definitely doesn’t make it easier.

There absolutely are programs that make sense to run in docker, but Plex server isn’t one of them.

[–] Nibodhika@lemmy.world 2 points 2 months ago

Plex server doesn’t need to be “portable”

Strongly disagree, I've switched my media server several times in the past decade for a multitude of reasons, having things in docker has allowed me to do this seamlessly.

Also you're ignoring all of the other benefits of running in docker, from isolation to automation.

and running it in docker definitely doesn’t make it easier.

Plex is the only self-hosted service that is purposefully trying to block you from being ran in docker. All other things are just much easier to run in docker, that's part of the appeal, reproducible builds eliminate the "it works on my machine" errors.

There absolutely are programs that make sense to run in docker, but Plex server isn’t one of them.

Why do you think it doesn't make sense? Does Jellyfin make sense to you to run in docker? Why are they different?

Also, Plex only supports Ubuntu and CentOS, none of which I run on my server, so the only OFFICIAL way to run Plex is Docker.