I use mTLS by adding a reverse proxy between Jellyfin and the Inet. This makes it hard to use the app, but works perfect with a browser. If you still want to use the app. There is a solution by using stunnel (termux) between te app and the Inet or better, a wireguard VPN.
Selfhosted
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.
Rules:
-
Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.
-
No spam posting.
-
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.
-
Don't duplicate the full text of your blog or github here. Just post the link for folks to click.
-
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
-
No trolling.
Resources:
- selfh.st Newsletter and index of selfhosted software and apps
- awesome-selfhosted software
- awesome-sysadmin resources
- Self-Hosted Podcast from Jupiter Broadcasting
Any issues on the community? Report it using the report flag.
Questions? DM the mods!
For now just Tailscale but I'm working on setting up a reverse proxy and SSO through Authentik
Even more secure is having a VPS and self hosting Heascale, even better is Wireguard
I'm trying to move away from needing a VPN to connect to make it simpler for less technically inclined family members
Usually just needs to be set up once. A small price to pay for security.
Sad that mTLS support is non existent because it solves this problem.
It would cover all phones, pcs and maybe Android TVs.
The barrier to entry would be having to replace the cert every year since we now made that a thing. Maybe spin up a self-sign shirt server and start issuing people 10 years certs
I just expose my local machine to the internet, unsecured
Yea same I don’t even care.
It’s an old laptop, I have a backup. Go ahead, fuck it up.
Do you at least have it on a VLAN?
I dunno. It’s plugged in directly to the modem/router provided by my ISP while my wifi is provided by a separate mesh setup, which is also plugged in to the modem/router 🤷♂️
Yeah, you’ll definitely want to make sure that computer is isolated. It doesn’t sound like it’s currently on a VLAN. The real danger isn’t just someone messing up that one machine, once they’re in, they’re behind your firewall and can potentially access anything else on your network. Smart home devices are often the next targets, things like light bulbs, security cameras, and especially Windows computers, which are usually easy to compromise if they’re on the same network.
You might be wondering, “How likely is that?” Honestly, very likely. Back when my website was online, it would get hit by hackers, mostly script kiddies, several times an hour.
This is absolutely unhinged but god damn it, I respect you.
Thanks stranger over the internet seems like the best option.
Tailscale with self hosted headscale
Any helpful tips or links to tutorials for this method?
Easiest method is Docker, but it heavily depends on your network and tech stacks.