Selfhosted
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.
Rules:
-
Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.
-
No spam posting.
-
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.
-
Don't duplicate the full text of your blog or github here. Just post the link for folks to click.
-
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
-
No trolling.
-
No low-effort posts. This is subjective and will largely be determined by the community member reports.
Resources:
- selfh.st Newsletter and index of selfhosted software and apps
- awesome-selfhosted software
- awesome-sysadmin resources
- Self-Hosted Podcast from Jupiter Broadcasting
Any issues on the community? Report it using the report flag.
Questions? DM the mods!
view the rest of the comments
I work in security as well.
If you only have a single user that accesses via a single static IP then it isn't much of an issue to manually maintain an IP whitelist.
Allowing access to multiple users across many different networks, means that you're going to have to deal with their IP changing frequently often multiple times per day. You'd have to be available full-time to update your whitelist if done manually.
If you're going to run software on those machines to check for their public IP and report it to you (or a script you run) in order to update your firewall's whitelist then you could just as easily (or, I'd argue, more easily) run a Tailscale client on their machine and only give them access to Jellyfin via Tailscale's ACL.
I just mean that you can't simply put Jellyfin behind a reverse proxy and alter some port forwarding rules to protect against the argument injection vulnerability, since it executes the ffmpeg command as the Jellyfin's service account so it would have access to any file that that account could access (which should be limited to the container, but some people run it bare metal still).
Using a VPN is just easier to deal with, to me, than trying to allow any access from Internet IPs. The firewall can simply block everything from the Internet that isn't VPN traffic. This is especially true if you control all of the devices that will be connecting to your network.
All of my traffic, even LAN traffic, is on one VPN or another. Everything is done 'locally' on the VPNs regardless of where the device is located.
I think we're arguing two sides of the same coin.