First things first, the setup is currently up and running. but i would like to modify it to use a reverse proxy through my personal domain.
Currently, i’m using an old pc with Truenas and a jail with jellyfin in it. i’m connecting to it with the free Fritz!Box VPN service.
but that’s stupid and slow. so i’ve bought a domain at godaddy.com. but i don’t understand the principle of whatever is managing the domain knowing the public IP-adress of my server. i’ve heard of Caddy, but it’s also running locally, so i don’t understand how i connect the pc to the domain.
if anyone could simplify this down for me, it’d be very helpful.
There’s plenty of reasons why you would not want to have a Jellyfin server be publicly available (even behind authentication). It’s simply not a well-secured system at this point (and may not get there for a long time, because it’s not a focus).
I strongly suggest keeping it accessed via VPN.
But note that VPN access is not necessarily any slower than “publicly” serving the HTTPs directly, at least not by much.
If you don’t already use Wireguard as the protocol, then maybe consider running a wireguard VPN instead, that tends to be quicker than classic OpenVPN.
And last but not least: a major restricting factor in performance of media servers from afar is the upload speed of your ISP connection, which is very often much lower than your download (100Mbit/10Mbit are common here, for example, so only 10% of the speed up than down).
I just recently set up a reverse proxy with Nginx Reverse Proxy, and Cloudflare. I pointed my domain to my home address with Cloudflare (they have dynamic DNS capability), then set up NRP, to forward traffic by subdomain. The nice thing about the reverse proxy it is I can bind a subdomain to an ip:port on my local network. Like “music.!MYIP!.com” goes to my Navidrome instance “LOCALIP:4553”. This allows me to close unnecessary outbound ports.
Configure your router to forward your jellyfin port to the server.
The working principle is: your home has a dynamic IP address that might change at any time. You’re going to use a dynamic DNS service do to have a domain name that always points to the correct IP. To accomplish this you’ll be required to install a small tool in your server that monitors your public IP and whenever it changes calls the dynamic DNS service with the update. The best part is that you don’t even need to own a domain for that.
i may have figured something out, godaddy doesn’t support ddns, but you can change the ip of an A record via the API. and i have found a program that runs under linux as a service that does exactly that. problem is, where in my nas do i run it? do i try to install it in truenas? or jellyfin? or do i create a new jail with the sole purpose of running said program?
To connect your domain to your IP use godaddy website, it should have a section where you can configure a dns entry, you can specify an IP address (your public IP) and, after a while, every device on the internet connecting to YOURDOMAIN.COM will be send to your home. If godaddy doesn’t offer a dns service you have to buy it somewhere else like on cloudflare, here I think you will need to prove that you own YOURDOMAIN.COM and then setup your IP in the dns. If you don’t have a static IP you need a DDNS (Dynamic DNS).
After that you open the port number 443 on your home router so that https requests will be send to a device of your choice, this device will host your reverse proxy, the reverse proxy binds a domain name (the one you brought) or a sub domain to a service of you choice on your local network, doing this you don’t expose the local server directly and you need to open a single port only.
I bought a domain on namecheap.com and it has a configurable dns built in so I hope that godaddy has one too. I use Caddy as a reverse proxy for my jellyfin instance instead of Nginex, I think that they are both valid, another thing other people said in the comment is to access jellyfin via wireguard tunnel and I confirm that is the best choice if you don’t have specific needs, let me explain.
The reverse proxy automatically generates ssl certificates using let’s encrypt allowing you to cast from an android phone to a Google chromecast (this seems to be the only way to do it and works very well for me).
I also configured other services on caddy, in my setup I block every request to the reverse proxy that doesn’t arrive from inside my local network (except jellyfin so I can use it remotely), I know that it’s not the intended use of a reverse proxy but it makes some things possible that otherwise will need more configuration:
I have two separate networks in my home, my reverse proxy has a double interface so I can easily access all services from devices on the main network.
I don’t need to configure local dns rewrites to my services neither I have to add exceptions for dns rebind inside my router, I simply add a new rule to caddy and it just work.
I have https for every service on my network without annoying messages on the browser.
If you think this lazy use of the reverse proxy could be a problem please tell me your thoughts!
You are not logged in. However you can subscribe from another Fediverse account, for example Lemmy or Mastodon. To do this, paste the following into the search field of your instance: !selfhosted@lemmy.world
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don’t control.
Rules:
Be civil: we’re here to support and learn from one another. Insults won’t be tolerated. Flame wars are frowned upon.
No spam posting.
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it’s not obvious why your post topic revolves around selfhosting, please include details to make it clear.
Don’t duplicate the full text of your blog or github here. Just post the link for folks to click.
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
There’s plenty of reasons why you would not want to have a Jellyfin server be publicly available (even behind authentication). It’s simply not a well-secured system at this point (and may not get there for a long time, because it’s not a focus).
I strongly suggest keeping it accessed via VPN.
But note that VPN access is not necessarily any slower than “publicly” serving the HTTPs directly, at least not by much.
If you don’t already use Wireguard as the protocol, then maybe consider running a wireguard VPN instead, that tends to be quicker than classic OpenVPN.
And last but not least: a major restricting factor in performance of media servers from afar is the upload speed of your ISP connection, which is very often much lower than your download (100Mbit/10Mbit are common here, for example, so only 10% of the speed up than down).
I just recently set up a reverse proxy with Nginx Reverse Proxy, and Cloudflare. I pointed my domain to my home address with Cloudflare (they have dynamic DNS capability), then set up NRP, to forward traffic by subdomain. The nice thing about the reverse proxy it is I can bind a subdomain to an ip:port on my local network. Like “music.!MYIP!.com” goes to my Navidrome instance “LOCALIP:4553”. This allows me to close unnecessary outbound ports.
Your basic requirements are:
The working principle is: your home has a dynamic IP address that might change at any time. You’re going to use a dynamic DNS service do to have a domain name that always points to the correct IP. To accomplish this you’ll be required to install a small tool in your server that monitors your public IP and whenever it changes calls the dynamic DNS service with the update. The best part is that you don’t even need to own a domain for that.
Depending on how many people you want connected, could try something like tailscale or zerotier. I been using tailscale and I think it is easier.
i may have figured something out, godaddy doesn’t support ddns, but you can change the ip of an A record via the API. and i have found a program that runs under linux as a service that does exactly that. problem is, where in my nas do i run it? do i try to install it in truenas? or jellyfin? or do i create a new jail with the sole purpose of running said program?
https://github.com/navilg/godaddy-ddns
Definitely ditch godaddy asap they are one of the worst companies to deal with.
I suggest https://njal.la/
To connect your domain to your IP use godaddy website, it should have a section where you can configure a dns entry, you can specify an IP address (your public IP) and, after a while, every device on the internet connecting to YOURDOMAIN.COM will be send to your home. If godaddy doesn’t offer a dns service you have to buy it somewhere else like on cloudflare, here I think you will need to prove that you own YOURDOMAIN.COM and then setup your IP in the dns. If you don’t have a static IP you need a DDNS (Dynamic DNS). After that you open the port number 443 on your home router so that https requests will be send to a device of your choice, this device will host your reverse proxy, the reverse proxy binds a domain name (the one you brought) or a sub domain to a service of you choice on your local network, doing this you don’t expose the local server directly and you need to open a single port only.
I bought a domain on namecheap.com and it has a configurable dns built in so I hope that godaddy has one too. I use Caddy as a reverse proxy for my jellyfin instance instead of Nginex, I think that they are both valid, another thing other people said in the comment is to access jellyfin via wireguard tunnel and I confirm that is the best choice if you don’t have specific needs, let me explain. The reverse proxy automatically generates ssl certificates using let’s encrypt allowing you to cast from an android phone to a Google chromecast (this seems to be the only way to do it and works very well for me). I also configured other services on caddy, in my setup I block every request to the reverse proxy that doesn’t arrive from inside my local network (except jellyfin so I can use it remotely), I know that it’s not the intended use of a reverse proxy but it makes some things possible that otherwise will need more configuration:
If you think this lazy use of the reverse proxy could be a problem please tell me your thoughts!