when reading through the jellyfin with chromecast guide i realized that it would probably be less effort to just let the casting api be public, with the added bonus that i could then cast my library to any device that supports it. but that seems like it would paint a giant target on the server.
what’s the recommended way of doing stuff like this? ideally i want to be able to go to someone’s house and just play some of my media on their tv.
not that any of this is doable in the near future, since i’m behind cgnat and won’t get my colocated bounce server up until spring.
Your SSH setup is good.
ssh is a very resilient piece of software so I doubt with your setup you would encounter any issues.
Enforcing use of a VPN to get into your network before being able to ssh into a machine is mostly just an extra layer of defense, though using a non-standard port, only allowing key logins and disabling root user login are all layers of defense you have already added.
I thinj you’ll be fine, but if you are worried, you could setup a VPN or alternatively something like Fail2Ban if you notice any brute-force attacks (which may be unlikely with the use of a non-standard port).
It’s down to how secure the software is really.
Jellyfins (and other software) don’t use really secure web servers for getting themselves accessible via the network.
Caddy (a reverse proxy, for example) is made to be exposed to the internet and so it is more resilient and safe to use.
So putting the resilient software (a good reverse proxy) infront of Jellyfin (or most other software) simply increases your security by having the more safe web server be the one interfacing with end users.
Have fun on your journey!
Okay cool, thanks for that follow-up and confirming my SHH setup seems reasonable. 🙏
There’s one thing I don’t really get though, with the whole reverse proxy thing and how that’s supposedly safer:
Like, once a user client has contact with the Jellyfin instance, via the reverse proxy, wouldn’t the Jellyfin instance be just as vulnerable as without the reverse proxy? Once a connection is established, or found to be available, you could just start exploiting away in the same way, right? Or wrong? If wrong, how? 😅 Maybe it’s too long for a text reply? Maybe I should watch some helpful video explaining how it works. 😁
No problemo.
Thanks for pointing out the reverse proxy comment. I think I was wrong to say simply putting jellyfin behind a reverse proxy will increase your security.
The benefits may only be minute or non-existent if you don’t use the reverse proxy for handling other stuff like HTTPS (and redirects to https, etc), restricting access or adding extra authentication requirements (mainly https).
It may also be good to note that Jellyfins docs explicitly do not recommend directly exposing jellyfin ports to the internet (a reverse proxy or using a vpn are recommended instead).
Still I will continue to feel safer always using a reverse proxy when I expose to the internet (maybe my misconceptions).
Thanks again, mate. So basically, if I’m exposing my junk to the world, and by junk I mean service(s), and by world I mean the open internet, I should do it using a reverse proxy and enable HTTPS, otherwise it’s not really very secure? Would that be a reasonable takeaway?
Yet again, thanks. Especially for pointing out the things you (may) be not so sure about. That’s admirable. 🫡