I already host multiple services via caddy as my reverse proxy. Jellyfin, I am worried about authentication. How do you secure it?

  • danA
    link
    fedilink
    English
    arrow-up
    55
    arrow-down
    2
    ·
    edit-2
    2 days ago

    Is it just you that uses it, or do friends and family use it too?

    The best way to secure it is to use a VPN like Tailscale, which avoids having to expose it to the public internet.

    This is what I do for our security cameras. My wife installed Tailscale on her laptop and phone, created an account, and I added her to my Tailnet. I created a home screen icon for the Blue Iris web UI on her phone and mentioned to her, “if the cameras don’t load, open Tailscale and make sure it’s connected”. Works great - she hasn’t complained about anything at all.

    If you use Tailscale for everything, there’s no need to have a reverse proxy. If you use Unraid, version 7 added the ability to add individual Docker containers to the Tailnet, so each one can have a separate Tailscale IP and subdomain, and thus all of them can run on port 80.

    • paequ2@lemmy.today
      link
      fedilink
      English
      arrow-up
      15
      ·
      2 days ago

      if the cameras don’t load, open Tailscale and make sure it’s connected

      I’ve been using Tailscale for a few months now and this is my only complaint. On Android and macOS, the Tailscale client gets randomly killed. So it’s an extra thing you have to manage.

      It’s almost annoying enough to make me want to host my services on the actual internet… almost… but not yet.

      • Byter@lemmy.one
        link
        fedilink
        English
        arrow-up
        6
        ·
        1 day ago

        If you make Tailscale your VPN in Android it will never be killed. Mileage may vary depending on flavor of Android. I’ve used this on stock Pixel and GrapheneOS.

        Under Settings > Network and internet > VPN

        Tap the Cog icon next to Tailscale and select Always-on VPN.

      • Lem453@lemmy.ca
        link
        fedilink
        English
        arrow-up
        14
        ·
        2 days ago

        I use plain wireguard on me phone, always on essentially with no issues. I wonder why tailscale app can’t stay open.

        • beerclue@lemmy.world
          link
          fedilink
          English
          arrow-up
          9
          ·
          2 days ago

          Same, wireguard with the 'WG Tunnel" app, which adds conditional Auto-Connect. If not on home wifi, connect to the tunnel.

          • Lem453@lemmy.ca
            link
            fedilink
            English
            arrow-up
            2
            arrow-down
            2
            ·
            2 days ago

            I just stay connected to wireguard even at home, only downside is the odd time I need to chromecast, it needs to be shut off.

            • bonsai@lemmy.dbzer0.com
              link
              fedilink
              English
              arrow-up
              1
              ·
              1 day ago

              Can you add a split tunnel for just the Chromecast app (I presume that’s how it works idk I don’t use Chromecast) so that just that specific app always ignores your VPN?

              • Lem453@lemmy.ca
                link
                fedilink
                English
                arrow-up
                1
                ·
                1 day ago

                I haven’t tried it, but the app has the ability to select which app it tunnels.

                When you make a new tunnel, it says “all applications” if you click on that you can select specific ones to include or exclude

          • danA
            link
            fedilink
            English
            arrow-up
            1
            arrow-down
            2
            ·
            edit-2
            1 day ago

            conditional Auto-Connect. If not on home wifi, connect to the tunnel.

            You don’t need this with Tailscale since it uses a separate IP range for the tunnel.

            Edit: Tailscale (and Wireguard) are peer-to-peer rather than client-server, so there’s no harm leaving it connected all the time, and hitting the VPN IPs while at home will just go over your local network.

            The one thing you probably wouldn’t do at home is use an exit node, unless you want all your traffic to go through another node on the Tailnet.

              • danA
                link
                fedilink
                English
                arrow-up
                1
                ·
                edit-2
                1 day ago

                If you have a separate subnet for it, then why do you only want it to be connected when you’re not on home wifi? You can just leave it connected all the time since it won’t interfere with accessing anything outside that subnet.

                One of the main benefits of Wireguard (and Tailscale) is that it’s peer-to-peer rather than client-server. You can use the VPN IPs at home too, and it’ll add barely any overhead.

                (leaving it connected is assuming you’re not routing all your traffic through one of the peers)

                • beerclue@lemmy.world
                  link
                  fedilink
                  English
                  arrow-up
                  1
                  ·
                  1 day ago

                  My network is not publicly accessible. I can only access the internal services while connected to my VPN or when I’m physically at home. I connect to WG to use the local DNS (pihole) or to access the selfhosted stuff. I don’t need to be connected while I’m at home… In a way, I am always using the home DNS.

                  Maybe I’m misunderstanding what you’re saying…

                  • Lem453@lemmy.ca
                    link
                    fedilink
                    English
                    arrow-up
                    2
                    ·
                    1 day ago

                    He’s saying that while there is no benefit to being connect to WG at home, there is also no downside so many people just stay connected all the time.

        • paequ2@lemmy.today
          link
          fedilink
          English
          arrow-up
          3
          ·
          2 days ago

          I suspect that it goes down and stays down whenever there is an app update, but I haven’t confirmed it yet.

          Does the plain wireguard app stay up during updates?

          • Lem453@lemmy.ca
            link
            fedilink
            English
            arrow-up
            10
            ·
            edit-2
            2 days ago

            Android wireguard all hasn’t been updated in 18mo. Its extremely simple with a small code base. There basically isn’t anything to update. It uses wireguard kernel module which is itself is only like 700 lines of code. It so simple that it basically became stable very quickly and there is nothing left of update right now.

            https://git.zx2c4.com/wireguard-android/about/

            I personally get the from obtainium to bypass play store

        • danA
          link
          fedilink
          English
          arrow-up
          2
          ·
          1 day ago

          I did this and it still seems to randomly disconnect.

        • ladfrombrad 🇬🇧@lemdro.id
          link
          fedilink
          English
          arrow-up
          3
          ·
          edit-2
          2 days ago

          It loses its foreground notification I’ve found that kills it for me

          even thou the Quick Toggle and the app itself, shows as running

          If I disconnect/reconnect the notification comes back, and I’ve found something even more weird on my device (A Xiaomi with its infamous OOM / background app killer…) is Tailscale still actually works fine most of the time without the foreground notification. I’m hazarding a 70% of the time for me?

          A lot of us a while back found v1.5.2 fugged around with the persistent notification going RIP

          https://github.com/tailscale/tailscale/issues/10104

          • LiveLM@lemmy.zip
            link
            fedilink
            English
            arrow-up
            2
            ·
            1 day ago

            Oh the Quick Toggle has never, ever worked correctly. I hoped they fixed it after the UI refresh update but unfortunately not yet.

            • ladfrombrad 🇬🇧@lemdro.id
              link
              fedilink
              English
              arrow-up
              2
              ·
              edit-2
              1 day ago

              What device/ROM are you using?

              It’s been very iffy for me on and off from Miui > HyperHyperOS, but just checking now?

              Works fine

              Like I say, the foreground notification seemed to be the lifeline to some of us using it and keeping it alive, even after IIRC some more restrictions came in with future versions of Android (forgive me, I’m very lazy these days and just skim Mishaal’s TG feed 😇)?

              e: also dupe comment ;)

                • ladfrombrad 🇬🇧@lemdro.id
                  link
                  fedilink
                  English
                  arrow-up
                  2
                  ·
                  edit-2
                  1 day ago

                  Huh. The nearest I have to an actual “AOSP” device is my King Kong Cubot phone that has probably the cleanest version of “stock Android” I’ve ever seen, and I’m going to presume you mean like a Google Pixel / Graphene etc?

                  Tailscale and the QS tile / notification was solid on that Cubot but to be honest, I’ve barely turned it on these days and is now one of those drawer phones.

                  Miui / HyperHyperOS though is a different kettle of fish and exempting Tailscale from its App lel Killer does seem to work. 70-80%ish…

                  But there is something that just fuggs up and turn it off/on like most thingys I own 🙈

                • dai@lemmy.world
                  link
                  fedilink
                  English
                  arrow-up
                  1
                  ·
                  1 day ago

                  Works great and has been for some time on my P7P.

                  Ensure you’ve allowed background usage and turn off manage app if unused.

                  Keep the notification on and allow notifications.

          • LiveLM@lemmy.zip
            link
            fedilink
            English
            arrow-up
            1
            ·
            1 day ago

            Oh the Quick Toggle has never, ever worked correctly. I hoped they fixed it after the UI refresh update but unfortunately not yet.

        • danA
          link
          fedilink
          English
          arrow-up
          2
          ·
          1 day ago

          Headscale is a replacement for the coordination servers, which are only used to distribute configs and help nodes find each other. It won’t change client-side behaviour.

      • danA
        link
        fedilink
        English
        arrow-up
        1
        ·
        2 days ago

        deleted by creator