First things first, the setup is currently up and running. but i would like to modify it to use a reverse proxy through my personal domain.
Currently, i’m using an old pc with Truenas and a jail with jellyfin in it. i’m connecting to it with the free Fritz!Box VPN service.
but that’s stupid and slow. so i’ve bought a domain at godaddy.com. but i don’t understand the principle of whatever is managing the domain knowing the public IP-adress of my server. i’ve heard of Caddy, but it’s also running locally, so i don’t understand how i connect the pc to the domain.
if anyone could simplify this down for me, it’d be very helpful.
I assume you have a dynamic ip. what I did for that scenario: setup a dyndns hostname somewhere, configure a subdomain (e.g. jellyfin.example.com) with a cname dns record pointing to the dyndns hostname. you will have to setup updating of the dyndns hostname, this can be done in the fritz box and port forwarding to your jellyfin pc.
IPv6 may also “just work” nowadays, too, especially if the aim is to connect from mobile or other consumer networks. Corporate environments are still hit & mostly miss.
you mean without a dynamic hostname in between? but then you would still need to know about a changed prefix, wouldn’t you?
Your basic requirements are:
- Some kind of domain / subdomain payed or free;
- Home ISP that has provides public IP addresses - No CGNAT BS;
- A dynamic DNS service such as https://freedns.afraid.org/;
- Configure your router to forward your jellyfin port to the server.
The working principle is: your home has a dynamic IP address that might change at any time. You’re going to use a dynamic DNS service do to have a domain name that always points to the correct IP. To accomplish this you’ll be required to install a small tool in your server that monitors your public IP and whenever it changes calls the dynamic DNS service with the update. The best part is that you don’t even need to own a domain for that.
i don’t understand how i connect the pc to the domain.
Yeah, that’s the part where I think there’s some misunderstanding. You don’t “connect” the server to your domain. Instead, there is a Nameserver (most run by your registrar, GoDaddy) that hosts a list of DNS records, that you can edit, which point to IPs. So you need to edit those to point to your public IP (or set up stuff like DynDNS if your IP isn’t static) and once that’s doneand the port forwarding is also set up properly in the Fritz!Box you should be able to connect.
That said, what’s wrong with VPN? Particularly if you’re using Wireguard VPN, which was recently added to Fritz!Box, there shouldn’t be any performance differences. Plus, it would be safer than exposing services to the whole internet, doubly so if you’re not a networking expert.
I‘m trying to set it up so i don‘t have to switch VPNs on my phone all the time. Also my Company IPad doesn‘t allow me to set up my own VPN connection.
I am not sure you should be connecting from a Company ipad to a Jellyfin server anyway. Well, unless its your own company I guess. Company IT may monitor what you are doing on it.
It depends on what all you want to proxy in, if it’s just that one thing then it’s pretty simple to point a port inbound to a secure interface and call it a day.
For a more complete thing, an inbound proxy will take the requested domain coming into your front door and translate it to an IP/port combo on the inside. That way you can have several services behind the single IP. If you have a full gateway server setup in frontt of things something like HAProxy or squid can work and do SSL offloading for you. For a single server setup you might look at ‘nginx proxy manager’ (NPM) which gives an easy way to set up an inbound proxy plus it’ll manage getting certificates from let’s encrypt automatically.
I could help more fully but need a good bit more details to give some specific ideas.
If I wanted to access my Jellyfin at home from a smart TV elsewhere, is that possible (securely)? Or would I need something that can run a vpn?
With the caveat that I’m presuming Jellyfin has a HTTPS interface, or you have a proxy in front of it to make one for it (I use Emby myself but I believe Jellyfin was a fork of it at some point) then yes, if the TV has an app for it you should be fine. HTTPS is as good on your server as anywhere else so long as it doesn’t have some implementation flaw. In fact it’s probably better to not have a VPN when streaming video just to avoid the extra overhead bandwidth a VPN tends to add on.
My only thought against having it on the public web would be the potential for brute force attempts on the login page. If it has a 2 factor option then great, or even if there’s some kind of lockout/throttling after too many wrong guesses. Even barring that though, a decent long pass should be good enough to dissuade anyone from wasting too much time trying to remotely get into a video box, not exactly a crown jewel target after all.
Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:
| Fewer Letters | More Letters |
|---|---|
| CGNAT | Carrier-Grade NAT |
| DNS | Domain Name Service/System |
| HTTP | Hypertext Transfer Protocol, the Web |
| HTTPS | HTTP over SSL |
| IP | Internet Protocol |
| NAT | Network Address Translation |
| SSL | Secure Sockets Layer, for transparent encryption |
| VPN | Virtual Private Network |
| nginx | Popular HTTP server |
[Thread #241 for this sub, first seen 25th Oct 2023, 10:45] [FAQ] [Full list] [Contact] [Source code]
