How to secure Jellyfin hosted over the internet?

So i’ve been trying to set this up this exact thing for the past few weeks - tried all manner of different Nginx/Tailscale/VPS/Traefik/Wireguard/Authelia combos, but to no avail

I was lost in the maze

However, I realised that it was literally as simple as setting up a CloudFlare Tunnel on my particular local network I wanted exposed (in my case, the Docker network that runs the JellyFin container) and then linking that domain/ip:port within CloudFlare’s Zero Trust dashboard

Cloudflare then proxies all requests to your public domain/route to your locally hosted service, all without exposing your private IP, all without exposing any ports on your router, and everything is encrypted with HTTPS by default

And you can even set up what looks like pretty robust authentication (2FA, limited to only certain emails, etc) for your tunnel

Not sure what your use case is, but as mine is shared with only me and my partner, this worked like a charm

Pay attention to your email, when cloudflare decides to warn you for this (they will, it's very very much against TOS) they'll send you an email, if you don't remove the tunnel ASAP, your entire account will be terminated.
I'm pretty sure that using Jellyfin over Cloudflare tunnels is against their TOS, just FYI. I'm trying to figure out an alternative myself right now because of that.

Is it just you that uses it, or do friends and family use it too?

The best way to secure it is to use a VPN like Tailscale, which avoids having to expose it to the public internet.

This is what I do for our security cameras. My wife installed Tailscale on her laptop and phone, created an account, and I added her to my Tailnet. I created a home screen icon for the Blue Iris web UI on her phone and mentioned to her, "if the cameras don't load, open Tailscale and make sure it's connected". Works great - she hasn't complained about anything at all.

If you use Tailscale for everything, there's no need to have a reverse proxy. If you use Unraid, version 7 added the ability to add individual Docker containers to the Tailnet, so each one can have a separate Tailscale IP and subdomain, and thus all of them can run on port 80.

For web access, stick it behind a reverse proxy and use something like Authentik/Authelia/SSO provider of your choice to secure it.

For full access including native clients, set up a VPN.

I use Tailscale right now. Which, in fairness, I didn't state in the post. However, I was hoping to share it more similarly to how I used to with Plex. But, it would appear, I would have to share it through Tailscale only at this point.
- Right now none of the native clients support SSO. It is a frequently requested feature but, unfortunately, it doesn't look like it will be implemented any time soon. As with many OSS projects it is probably a case of "you want it, you build it" - but nobody has actually stepped up.

My setup: Locally (all in docker):

JF for managing and local access
JF with read only mounted volumes that uses the network of my Wireguard client container
Wireguard client opening a tunnel to Wireguard server on VPS ** Ping container regularly doing pings to Wireguard Server so the connection stays up (didn't manage it otherwise)

VPS (Oracle Cloud free tier, also everything in docker):

Caddy as a reverse proxy with https enabled and geolocking (only certain countries are allowed to connect to)
fail2ban to block IPs that try to bruteforce credentials
Wireguard server

Usernames are not shown in the frontend and have to be entered. Passwords are generated by a password manager and can't be changed by the user.

So my clients just get the URL of my reverse proxy and can access the read only JF through my Wireguard tunnel. Didn't have to open any ports on my side. If someone is interested I can share the docker compose files later.

Edit: Here the link to the setup description. Please tell me if something is not clear or you find an error. https://codeberg.org/skjalli/jellyfin-vps-setup

I am interested in your docker compose
- Will share this evening after work.
- https://codeberg.org/skjalli/jellyfin-vps-setup here you go, took me longer than expected and I hope it's helpful, might contain a few errors since I had to remove some settings but I guess this should work.
I'm more interested in the fail2ban setup. How did you do that for Jellyfin? Is it through a plugin?
- It's a separate container, currently in the process of writing everything up, will update once done
This seems like a developer/infrastructure level job, any dumb down step by step procedure to recommend?
- I am currently in the ptocess to document my docker fioes and upload them to codeberg with a readme, it takes a bit, will let you know once I am done
- https://codeberg.org/skjalli/jellyfin-vps-setup here you go, took me longer than expected and I hope it's helpful, might contain a few errors since I had to remove some settings but I guess this should work.

What I used to do was: I put jellyfin behind an nginx reverse proxy, on a separate vhost (so on a unique domain). Then I added basic authentication (a htpasswd file) with an unguessable password on the whole domain. Then I added geoip firewall rules so that port 443 was only reachable from the country I was in. I live in small country, so this significantly limits exposure.

Downside of this approach: basic auth is annoying. The jellyfin client doesn't like it ... so I had to use a browser to stream.

Nowadays, I put all my services behind a wireguard VPN and I expose nothing else. Only issue I've had is when I was on vacation in a bnb and they used the same IP range as my home network :-|

Tailscale is awesome. Alternatively if you're more technically inclined you can make your own wireguard tailscale and all you need is to get a static IP for your home network. Wireguard will always be safer than each individual service.

Love tailscale. The only issue I had with it is making it play nice with my local, daily driver VPN. Got it worked out tho. So, now everything is jippity jippity.
all you need is to get a static IP for your home network

Don't even need a static IP. Dyndns is enough.
- Unless you're behind cgnat and without ipv6 support.

I use good ol' obscurity. My reverse proxy requires that the correct subdomain is used to access any service that I host and my domain has a wildcard entry. So if you access asdf.example.com you get an error, the same for directly accessing my ip, but going to jellyfin.example.com works. And since i don't post my valid urls anywhere no web-scraper can find them. This filters out 99% of bots and the rest are handled using authelia and crowdsec

Are you using HTTPS? It's highly likely that your domains/certificates are being logged for certificate transparency. Unless you're using wildcard domains, it's very easy to enumerate your sub-domains.
If you're using jellyfin as the url, that's an easily guessable name, however if you use random words not related to what's being hosted chances are less, e.g. salmon.example.com . Also ideally your server should reply with a 200 to * subdomains so scrappers can't tell valid from invalid domains. Also also, ideally it also sends some random data on each of those so they don't look exactly the same. But that's approaching paranoid levels of security.
That’s not how web scrappers work lol. No such thing as obscurity except for humans
- It seems to that it works. I don't get any web-scrapers hitting anything but my main domain. I can't find any of my subdomains on google.
  
  Please tell me how you believe that it works. Maybe i overlooked something...
And since i don't post my valid urls anywhere no web-scraper can find them

You would ah... be surprised. My urls aren't published anywhere and I currently have 4 active decisions and over 300 alerts from crowdsec.

It's true none of those threat actors know my valid subdomains, but that doesn't mean they don't know I'm there.
- Of course i get a bunch of scanners hitting ports 80 and 443. But if they don't use the correct domain they all end up on an Nginx server hosting a static error page. Not much they can do there

I use fail2ban to ban IPs that fall to login and also IPs that perform common scans in the reverse proxy

also have jellyfin disable the account after a number of failed logins.

I am using tailscale but I went a little further to let my family log in with their Gmail( they will not make any account for 1 million dollars)

Tailscale funneled Jellyfin Keycloak (adminless)

Private Tailscale Keycloak admin Postgres dB

I hook up jellyfin to Keycloak (adminless) using the sso plugin. And hook Keycloak up (using the private instance) to use Google as an identity provider with a private app.

SSO plugin is good to know about. Does that address any of the issues with security that someone was previously talking about?
- I'd say it's nearly as secure as
  
  basic authentication. If you restrict deletion to admin users and use role (or group) based auth to restrict that jellyfin admin ability to people with strong passwords in keycloak, i think you are good. Still the only risk is people could delete your media if an adminusers gmail is hacked.
  
  Will say it's not as secure as restricting access to vpn, you could be brute forced. Frankly it would be preferable to set up rate limiting, but that was a bridge too far for me

setup a WAF appliance and forward traffic through it to your current installation.

WAF??
- web application firewall.
  
  think of it like an intelligent firewall proxy that can take action against perceived threats like injection attacks or timed attacks. some can also help fight against DDOS when integrated with an actual firewall upstream.

Use a VPN like Tailscale

Whats your setup? I just Ngnix Proxy Manager, Jellyfin etc in Docker. Modify ufw rules and also install this on the server (linux) https://github.com/friendly-bits/geoip-shell

I have another site on a different port that sits behind basic auth and adds the IP to a short ipset whitelist.

So first I have to auth into that site with basic auth, then I load jellyfin on the other port.

I don't understand how that isn't widely deployed. I call it poor man's Zero Trust.
- I mean I'd rather jellyfin fix the bug and let me just put that behind basic auth

CloudFlare tunnel with Zero Trust, plus their bot and abuse blocking. Users can get in with the right oauth, plus only allowed from the countries I know they're in. Then just their username and password on jellyfin.

Doesn't streaming media over a cloudflare tunnel/proxy violate their ToS
- 🤫
- They prohibit large amounts of media being streamed, and they reserve the right to suspend or terminate accounts for it. Multiple years in, that has not happened.
  
  Edit: here, you can read https://blog.cloudflare.com/updated-tos/
- No, they removed that clause some 2 or 3 years back.
I hate the cloudflare stuff making me do captchas or outright denying me with a burning passion. My fault for committing the heinous crime of using a VPN!
- Skill issue
Using cloudflare tunnels means nothing is encrypted and cloudflare sees all.
- Oh no they'll see I'm watching TNG
just run wireguard on the jelly server..
- Can't use double VPN on mobile.
- My users aren't going to figure that out.

I use Pangolin (https://github.com/fosrl/pangolin)

URL is 404
- remove the brace at the end
- It's not, though?
I was thinking of setting this up recntly after seeing it on Jim's garage. Do you use it for all your external services or just jellyfin? How does it compare to a fairly robust WAF like bunkerweb?
- I use it for all of my external services. It's just wireguard and traefik under the hood. I have no familiarity with bunkerweb, but pangolin integrates with crowdsec. Specifically it comes out of the box with traefik bouncer, but it is relatively straightforward to add the crowdsec firewall bouncer on the host machine which I have found to be adequate for my needs.
Uhh, interesting! Thanks for sharing.

You could put authentik in front of it too

I think that breaks most clients
- ? How does putting something before it break it? It most certainly doesn’t.
- Yes, it breaks native login, but you can authenticate with Authentik on your phone for example, and use Quick connect to authorize non-browser sessions with it.

My setup is: Proxmox - restricted LXC running docker which runs jellyfin, tailscale funnel as reverse proxy and certificate provider. So so don't care about jellyfin security, it can get hacked / broken , its an end road. If so i will delete the LXC and bring it up again using backups. Also i dont think someone will risk or use time to hack a jellyfin server. My strategy is, with webservices that don't have critical personal data, i have them isolated in instances. I don't rely on security on anything besides the firewall. And i try not to have services with personal sensitive data, and if i do, on my local lan with the needed protections. If i need access to it outside my local lan, vpn.

~~Jellyfin is secure by default, as long as you have https. Just chose a secure password~~

No, it isn't.

EDIT: I quickly want to add that Jellyfin is still great software. Just please don't expose it to the public web, use a VPN (Wireguard, Tailscale, Nebula, ...) instead.
- Some of these are bonkers. The argument not to fix them because of backwards compatibility is even wilder. Which normal client would need the ability to get data for any other account that it hasn't the Auth token for.
- Wtf. Thank you
- Oh boy. Nope. My friends gonna have to fiddle with a VPN, forget exposing JF to the outside...
- I wouldn't say "great" it's ok software. Not even due to all of those security things which is a nightmare too. They do things like break the search speed months ago and not have any idea why, it's so insanely slow and on top of that it somehow lags the entire client when searching too, not just the server which is the only thing doing the query. Lots of issues just with that.

Kinda hard because they have an ongoing bug where if you put it behind a reverse proxy with basic auth (typical easy button to secure X web software on Internet), it breaks jellyfin.

Best thing is to not. Put it on your local net and connect in with a vpn

Mostly via empty threats, but occaisonally I have had to whip out the soccer ball