Selfhosted

Is it just you that uses it, or do friends and family use it too?

The best way to secure it is to use a VPN like Tailscale, which avoids having to expose it to the public internet.

This is what I do for our security cameras. My wife installed Tailscale on her laptop and phone, created an account, and I added her to my Tailnet. I created a home screen icon for the Blue Iris web UI on her phone and mentioned to her, "if the cameras don't load, open Tailscale and make sure it's connected". Works great - she hasn't complained about anything at all.

If you use Tailscale for everything, there's no need to have a reverse proxy. If you use Unraid, version 7 added the ability to add individual Docker containers to the Tailnet, so each one can have a separate Tailscale IP and subdomain, and thus all of them can run on port 80.

My setup: Locally (all in docker):

• JF for managing and local access
• JF with read only mounted volumes that uses the network of my Wireguard client container
• Wireguard client opening a tunnel to Wireguard server on VPS ** Ping container regularly doing pings to Wireguard Server so the connection stays up (didn't manage it otherwise)

VPS (Oracle Cloud free tier, also everything in docker):

• Caddy as a reverse proxy with https enabled and geolocking (only certain countries are allowed to connect to)
• fail2ban to block IPs that try to bruteforce credentials
• Wireguard server

Usernames are not shown in the frontend and have to be entered. Passwords are generated by a password manager and can't be changed by the user.

So my clients just get the URL of my reverse proxy and can access the read only JF through my Wireguard tunnel. Didn't have to open any ports on my side. If someone is interested I can share the docker compose files later.

Edit: Here the link to the setup description. Please tell me if something is not clear or you find an error. https://codeberg.org/skjalli/jellyfin-vps-setup

For web access, stick it behind a reverse proxy and use something like Authentik/Authelia/SSO provider of your choice to secure it.

For full access including native clients, set up a VPN.

I use fail2ban to ban IPs that fall to login and also IPs that perform common scans in the reverse proxy

Tailscale is awesome. Alternatively if you're more technically inclined you can make your own wireguard tailscale and all you need is to get a static IP for your home network. Wireguard will always be safer than each individual service.

What I used to do was: I put jellyfin behind an nginx reverse proxy, on a separate vhost (so on a unique domain). Then I added basic authentication (a htpasswd file) with an unguessable password on the whole domain. Then I added geoip firewall rules so that port 443 was only reachable from the country I was in. I live in small country, so this significantly limits exposure.

Downside of this approach: basic auth is annoying. The jellyfin client doesn't like it ... so I had to use a browser to stream.

Nowadays, I put all my services behind a wireguard VPN and I expose nothing else. Only issue I've had is when I was on vacation in a bnb and they used the same IP range as my home network :-|

I use good ol' obscurity. My reverse proxy requires that the correct subdomain is used to access any service that I host and my domain has a wildcard entry. So if you access asdf.example.com you get an error, the same for directly accessing my ip, but going to jellyfin.example.com works. And since i don't post my valid urls anywhere no web-scraper can find them. This filters out 99% of bots and the rest are handled using authelia and crowdsec

I am using tailscale but I went a little further to let my family log in with their Gmail( they will not make any account for 1 million dollars)

Tailscale funneled Jellyfin Keycloak (adminless)

Private Tailscale Keycloak admin Postgres dB

I hook up jellyfin to Keycloak (adminless) using the sso plugin. And hook Keycloak up (using the private instance) to use Google as an identity provider with a private app.

I've put it behind WireGuard since only my wife and I use it. Otherwise I'd just use Caddy or other such reverse proxy that does https and then keep Jellyfin and Caddy up to date.

I have another site on a different port that sits behind basic auth and adds the IP to a short ipset whitelist.

So first I have to auth into that site with basic auth, then I load jellyfin on the other port.

setup a WAF appliance and forward traffic through it to your current installation.

You could put authentik in front of it too

Whats your setup? I just Ngnix Proxy Manager, Jellyfin etc in Docker. Modify ufw rules and also install this on the server (linux) https://github.com/friendly-bits/geoip-shell