Hehe yep, that’s a good takeaway and the same as what I think.

Thank you too, i enjoyed this discussion.

No problemo.

Thanks for pointing out the reverse proxy comment. I think I was wrong to say simply putting jellyfin behind a reverse proxy will increase your security.

The benefits may only be minute or non-existent if you don’t use the reverse proxy for handling other stuff like HTTPS (and redirects to https, etc), restricting access or adding extra authentication requirements (mainly https).

It may also be good to note that Jellyfins docs explicitly do not recommend directly exposing jellyfin ports to the internet (a reverse proxy or using a vpn are recommended instead).

Still I will continue to feel safer always using a reverse proxy when I expose to the internet (maybe my misconceptions).

Your SSH setup is good.

ssh is a very resilient piece of software so I doubt with your setup you would encounter any issues.

Enforcing use of a VPN to get into your network before being able to ssh into a machine is mostly just an extra layer of defense, though using a non-standard port, only allowing key logins and disabling root user login are all layers of defense you have already added.

I thinj you’ll be fine, but if you are worried, you could setup a VPN or alternatively something like Fail2Ban if you notice any brute-force attacks (which may be unlikely with the use of a non-standard port).

What I meant with the Jellyfin question was kind of, how is having it exposed via a reverse proxy different from exposing its port right away? Is it because the only allowed connection would be HTTPS/encrypted etc, maybe?

It’s down to how secure the software is really.

Jellyfins (and other software) don’t use really secure web servers for getting themselves accessible via the network.

Caddy (a reverse proxy, for example) is made to be exposed to the internet and so it is more resilient and safe to use.

So putting the resilient software (a good reverse proxy) infront of Jellyfin (or most other software) simply increases your security by having the more safe web server be the one interfacing with end users.

Have fun on your journey!

If you don’t want to worry too much, you can setup a vpn (like wireguard) on your server for ssh access.

Using a non standard port is a good idea, but not entirely foolproof because bots might still port scan (even if unlikely that they do that for ssh I’m not sure). At a mininum, you probably want to use keys for login like the other commenter on the main comment said.

Personally, using a vpn for when I want access to SSH when I’m out is worth the couple hours setting it up the one time (very simple setup with wireguard-easy for example). Maintenence time spent on upgrading is very low.

(Tl;dr personally I’d use a vpn to access ssh specifically rather than exposing it to the internet)

Same thing for Jellyfin?

Not 100% sure what you mean, but to clarify: Don’t accidentally expose jellyfins port to the internet (eg the default port 8096). Make sure it is only accessible from outside your network through your reverse proxy.

I agree, there is a lot of paranoia, but honestly that’s probably a good thing, because the people who are paranoid might not know that much, so a good amount of paranoia is healthy there.

The chance of being exploited is very low for me to care too too much. Why spend countless days locking up my entire infra when there’s a very low low chance anyone could exploit me in the first place (obviously get your setup to a good standard, I don’t recommend not reading up on anything and exposing server, etc. Just for me, I don’t need to over do it).

That being said, personally I have ssh behind a vpn because that’s a very important service that only I am accessing anyways, so it makes sense for me to disable that attack vector.

The default configuration for Jellyfin is good. I mostly mean as long as you follow best practices in general you should be fine, eg:

• You keep your system and jellyfin updated;
• have some type of firewall in place;
• make sure you aren’t accidentally exposing jellyfins port directly to the internet;
• have a good password for your jellyfin accounts that are able to login from outside the LAN;
• and so on and so forth

https://jellyfin.org/docs/general/post-install/networking/reverse-proxy/

A firewall is probably the most important, having your ssh port blocked in the firewall being second.

As long as your jellyfin server is properly configured behind a reverse proxy, letting it be accessible publicly on the internet is fine.

Obviously everyone has their own threat model, but it’s not that big of a threat in this case (personally I don’t care).

Your wife sounds smart, listen to heerrrrrr.

Also I don’t know, but since hearing about non-stick pans leaking cancer into your food (if you scrape them with a fork, etc), I just like to use a normal pan.

Yeah, I think Letsencrypt (and others) are one of the best things to happen for the internet.

You used to have to cough up a good chunk of monies for a certificate.

Now it’s easily accessible and you (i) never have to think about it after the first setup because a robot automatically renews expiring certificates for me.

Generally this is one of the best improvements: a more secure web that is easier to achieve.

Yes and they keep doing this every other week it feels like.

I don’t know what’s gone wrong but they need to get real people making their code again (I’m assuming they have taken the leash off cursor in all their repos, because it feels like it!!!).

Seriously, please stop taking down the internet.

And second seriously we need a new alien age technology that can stop us having to route all of our traffic through one service.

There are tools for that, no?

You can install NAS software that turns self hosting stuff into one click installs.

Profit: $229

If it works for you, there’s no reason not to keep using it.

If it looks like an upgrade in performance and simplicity and you think it’s worth swapping, then you could consider it, though personally I’d wait until it’s a bit more mature/proven (maybe it is already idk).

A separate backup NAS would better than nothing. If losing your data would be a disaster, then don’t overlook backing up your data in a separate location (either at someone elses house or use a cloud backup provider like Backblaze) incase of a fire, etc.

Cloud or any way to backup your data in another location is greatly preferred to having another NAS in the same location just as a mirrored copy of your first.

Funny how all the things you listed aren’t “all they were cracked up to be” either.

I disagree regardless.

I’m gonna stuff that unlimited budget between the fabric layers of mine and take it home with me.

Usually fine for media only like Jellyfin, since you write every now and then new content, then only read from it for longer periods of time.

I probably wouldn’t go for a SMR drive anyways just because drives can last a long while and who knows what i’ll want to do with it in the future.

(If you use RAID, this advice doesn’t matter, but if you don’t run raid like me and only use it for media like in the example, I’d imagine it’d be fine)

Sounds good, I mean you can use literally anything to host servers.

It’s (debian) a great choice especially when you plan to only use docker though, for sure, as you won’t really run into those old package issues (+ if u like to upgrade and feel very safe doing so each time without looking at news first, might be survivorship bias, but debian has never broken for me through multiple major version upgrades and I’ve been blindly upgrading each time).

https://github.com/alexta69/metube does this very well already!