when reading through the jellyfin with chromecast guide i realized that it would probably be less effort to just let the casting api be public, with the added bonus that i could then cast my library to any device that supports it. but that seems like it would paint a giant target on the server.
what’s the recommended way of doing stuff like this? ideally i want to be able to go to someone’s house and just play some of my media on their tv.
not that any of this is doable in the near future, since i’m behind cgnat and won’t get my colocated bounce server up until spring.
As long as your jellyfin server is properly configured behind a reverse proxy, letting it be accessible publicly on the internet is fine.
Obviously everyone has their own threat model, but it’s not that big of a threat in this case (personally I don’t care).
This. People are overly paranoid nowadays.
I have had SSH open directly to my main PC for 15 years and never had any issues except spam logins. Just disallow password logins and you’re fine.
Same with :443 to my nginx.
I agree, there is a lot of paranoia, but honestly that’s probably a good thing, because the people who are paranoid might not know that much, so a good amount of paranoia is healthy there.
The chance of being exploited is very low for me to care too too much. Why spend countless days locking up my entire infra when there’s a very low low chance anyone could exploit me in the first place (obviously get your setup to a good standard, I don’t recommend not reading up on anything and exposing server, etc. Just for me, I don’t need to over do it).
That being said, personally I have ssh behind a vpn because that’s a very important service that only I am accessing anyways, so it makes sense for me to disable that attack vector.
Can you elaborate on ‘properly configured’?
The default configuration for Jellyfin is good. I mostly mean as long as you follow best practices in general you should be fine, eg:
https://jellyfin.org/docs/general/post-install/networking/reverse-proxy/
A firewall is probably the most important, having your ssh port blocked in the firewall being second.
So like if I want to access my PC from outside, is it enough that I don’t have a firewall installed but that I open up some random port and redirect it to my PC’s port 22, and then connect to it via the random port?
Same thing for Jellyfin?
If you don’t want to worry too much, you can setup a vpn (like wireguard) on your server for ssh access.
Using a non standard port is a good idea, but not entirely foolproof because bots might still port scan (even if unlikely that they do that for ssh I’m not sure). At a mininum, you probably want to use keys for login like the other commenter on the main comment said.
Personally, using a vpn for when I want access to SSH when I’m out is worth the couple hours setting it up the one time (very simple setup with wireguard-easy for example). Maintenence time spent on upgrading is very low.
(Tl;dr personally I’d use a vpn to access ssh specifically rather than exposing it to the internet)
Not 100% sure what you mean, but to clarify: Don’t accidentally expose jellyfins port to the internet (eg the default port 8096). Make sure it is only accessible from outside your network through your reverse proxy.
Also, don’t use the default “data/media/{library name}” (or whatever the suggested format is) folder setup that the Trash Guide has you set up. At least change the “tv”, “movies”, etc name to something different. Jellyfin has a known vulnerability where an attacker can get access to media without valid credentials if they already know the file path. Jellyfin devs have stated that they have no intention of ever fixing this, because it would require completely divesting from the Kodi branch that everything is built on. And since everyone follows the Trash Guide to set their *Arr stack and library up, guessing file paths is laughably easy.
You’re using the suggested file naming in your *Arr stack, so Jellyfin can automatically match media? Congrats, so is everyone else. You’re using the suggested folder layout so your *Arr stack can use hardlinks? Congrats, so is everyone else. At least change the library folder names. Since your library folder doesn’t need to match the name of your Jellyfin library, you can literally have your “tv”, “movies”, and other folders be named whatever you want. Hell, name your tv folder “peepee” and your movies folder “poopoo” for all I care.
That certainly sounds like a thing you would want, nay need, to fix.
This sounds like a blocker for me to not switch to Jellyfin… What else is in there that’s equally severe?
This needs to be copypasta’d as a reply to every comment suggesting that opening up jellyfin to the internet is easy and everyone should do it to get away from Plex.