Now that's an interesting thought.

A web page with Authelia, login and a firewall.

If you're not logged in, All you get is a login page. If you are logged in, It passes you straight through to jellyfin.

So any device and client would be able to access it without issue once a phone or computer on the network had logged in just once.

The web page modifies the HA proxy ACL and forces a reload.

Yeaaah ! Most people anyway have some kind of VPN installed on their device... Just slap in a wireguard VPN config to tunnel your traffic home... bOOm jellyfin everywhere and 99% secure !

I thought that you can still access media directly via the URL without any authentication, how would authelia change that?

Authelia is super easy, if the clients can handle it

Current Idea:

Traefik does most of this through plugins, except the whitelist modifier,

Whitelisted?

• user: https://bob.com:9901/ -> jellyfin

Not Whitelisted?

• user: https://bob.com:9901/ -> 404

Whitelisted or Not whitelisted?

• user: bob.com/whitelist -> nginx/python, authelia, fail2ban, traefik whitelist modifier

That's what I do myself but in a lot of cases VPN is beyond the grasp of the grasp of the friends and family that are being shared with.

Tailscale is somewhat approachable for this, there are a number of streaming devices that support TS clients. But then tailscale will eventually enshittify their free offering. Wrapping headscale into this will add yet another layer of complication. VPN is far more secure but I think it makes it unapproachably complicated for many.

Basic functionality, I've heard good things about the crappy Walmart ONN branded ones.

I know there are Alibaba options, But I'm awfully afraid of a lot of those have worst security issues than opening up jellyfin.

Bittorrent joined the room.

The Onn dongles from Walmart are probably the cheapest. The firestick should work fine and there are also Chromecasts from Google.

I would be very interested in an answer to this as well. Also any how to guides that would be useful for a guy whose technical high-water mark was getting mint set up on my laptop.

realistic security concerns

If you're running a binary installation of Jellyfin on your server and exposing it to the public internet, you can face significant risks:

• Remote execution vulnerabilities might allow attackers to exploit bugs to run malicious code on your server.

• Buffer overflows. Poorly handled data can let attackers manipulate memory, Bypass logins, touch things in the host that aren't meant to be twiddled with

• Network exposure. If compromised, the server could become a launchpad for attacks on your network.

There might not be any vulnerabilities at this moment, but they might come in a future release. And we might not even know they exist. It's a small team of volunteers, and they'll do their best. This is just what is reasonably possible when installing the server as an application on your OS and exposing it to the Internet.

You can minimize risk with a safer setup, as someone else in the comments here mentioned (and I think they even linked to their setup)

Using a Docker container version of the app significantly reduces your attack surface. This isolates the app from your host system. If they get in, they only get into the container and whatever that container is allowed to do.

Mount your media files as read-only to prevent accidental modifications or potential malicious changes. Now that container can't do any real harm do your data.

Avoid making the container privileged. A privileged container can interact with the host system in risky ways.

Use reasonable unique usernames and passwords. If the container does manage to get compromised, they will likely be able to read usernames and passwords stored in the container.

Regularly update your container – Ensures you have the latest security patches.

Short of some massive Docker vulnerability, (which is on you to keep updated) the worst case should be public enumeration of your media, exposure of your JF users/passwords, and denial of service. Which IMO isn't very serious.

For even tighter access control, don't whitelist the entire world.

Whitelist specific IP addresses. Have users visit WhatIsMyIP to get their IP, then configure port forwarding to allow only trusted addresses. This allows the clients at their houses in without any serious hinderance, but would block them from accessing your media when they're not at their house.

If they're accessing you through a phone or PC, setup headscale or tailscale or any VPN and allow them to get to you through VPN

Would you consider this a particularly constructive comment?

Its already installed, but missing features, i was waiting for them to finish the db changes, because thats whats blocking them...

What do you mean WinRAR isn’t free?!

Honestly, I'd be rather shocked if this wasn't already the case.

Moreover they probably have a database of everything you've ever watched and your IP and email address, just waiting to be leaked to the internet through sale or ransom.

Sell or get subpoena'd; tomayto, tomahto.

"Free Software" is a defined term: https://en.wikipedia.org/wiki/Free_software

Free as in freedom, not as in free beer.

Yeah, the wording is confusing. A long time ago, there was no paid software, there was only software where you got the source code and other software where e.g. it was pre-installed on some hardware and the manufacturer didn't want to give the source code.

In that time, a whole movement started fighting for software freedom, so they called their software "free".

I mean non-Free Software.

How is your underlying file system set up?

...wireguard

(there are android TV apps for wireguard, not that any normie can actually move a client file to it and turn it on, or could be bothered to)

You’ve got options.

Pangolin Wiredoor Cloudflare Tunnel Tailscale

I used synology and reverse proxy. It was pretty easy to set up. The tricky part was going into jellyfins setting and connecting your reverse proxy to the path you made.

Overall my kids and family can now access it anywhere.

Can your router open ports from a hostname vs an IP? If so, clients could run dynamic DNS.

WG client side isn't really that hard, though. All the fam run WG 24/7 on devices, and only traffic for the internal network goes through it.

https://github.com/SynoCommunity/spksrc/issues/5941 ?

I really wanted Jellyfin working in my DS214Play with DSM6, and I noticed that a package for these evansport CPUs doesn't exist and it's officially not supported, so I tried myself and I succeeded.