I already host multiple services via caddy as my reverse proxy. Jellyfin, I am worried about authentication. How do you secure it?

  • Lem453@lemmy.ca
    link
    fedilink
    English
    arrow-up
    2
    ·
    2 days ago

    He’s saying that while there is no benefit to being connect to WG at home, there is also no downside so many people just stay connected all the time.

    • beerclue@lemmy.world
      link
      fedilink
      English
      arrow-up
      1
      ·
      2 days ago

      Oh, I get that, but it just doesn’t make any sense to me to be physically next to the server, and connect to it via VPN…

      • danA
        link
        fedilink
        English
        arrow-up
        2
        ·
        2 days ago

        My point is that since the VPN uses a different subnet, it’s fine to keep it connected even at home. It’ll only use the VPN if you access the server’s VPN IP, not its regular IP.

        In any case, Tailscale and Wireguard are peer-to-peer, so the connection over the VPN is still directly to the server and there’s no real disadvantage of using the VPN IP on your local network.

        • beerclue@lemmy.world
          link
          fedilink
          English
          arrow-up
          1
          ·
          edit-2
          2 days ago

          Right, but I have wireguard on my opnsense. So when I want to reach https://jellyfin.example.com/ , if I am at home, it goes phone -> DNS -> proxy -> jellyfin (on the same network). If I am connected to the VPN, it goes from phone -> internet -> opnsense public ip -> wireguard subnet -> local subnet -> DNS -> proxy -> jellyfin. I see some unneeded extra steps here… Am I wrong?

          • danA
            link
            fedilink
            English
            arrow-up
            1
            ·
            edit-2
            1 day ago

            Oh yeah, there’ll be some overhead if you’re running Wireguard on a router. Hitting your router’s public IP won’t go out to the internet though - the router will recognize that it’s its IP.

            It’s common to run Wireguard on every computer/phone/tablet/etc where possible rather than just on the router, since this takes advantage of its peer-to-peer nature. For home use, that’s how it was originally designed to be used. Tailscale makes it a lot easier to configure it this way though - it’s a bit of work for vanilla Wireguard. Tailscale does support “subnet routers” if you have any devices that you want to access over the VPN that can’t run Tailscale.

            • beerclue@lemmy.world
              link
              fedilink
              English
              arrow-up
              1
              ·
              21 hours ago

              I don’t think I’ve ever encountered what you say… I use WG it to access a network, not a device. I have a few dozen devices, physical and virtual, why should I set up wg on all of them? Tailscale, maybe, it’s a different story, but I prefer to “self host” and not rely on a 3rd party provider. Wireguard was relatively easy to set up too, a few years ago… and in the meantime, if I need to add a new client, it’s a two minute job.

    • danA
      link
      fedilink
      English
      arrow-up
      1
      ·
      2 days ago

      Yeah, this. Plus if you leave it connected, you can use the VPN IPs while at home instead of having to use a different IP when at home vs when out (or deal with split horizon DNS)