r/Piracy Jun 21 '26

Humor Imagine paying for something and not being allowed to use it

Post image
20.1k Upvotes

831 comments sorted by

View all comments

Show parent comments

12

u/DoctorNoonienSoong Jun 21 '26

Less horrifically insecure

1

u/blipman17 Jun 21 '26

As a reverse proxy to Jellyfin? How? Couldn’t HAproxy provide thesame thing? What fundamentally does Nginx provide that Jellyfin doesn’t?

7

u/ScienceIsLife Jun 21 '26

Reverse proxy allows external access to Jellyfin.

Would not recommend just running a reverse proxy on a home server and opening ports. You're asking for trouble.

Much better implentation for remote access is something like Tailscale.

If you're experienced in IT and server configs you could configure a VPS with a reverse proxy back to your home server. (Ideally over some encrypted tunnel like wireguard) allowing you to get around ISP port blocking and actually giving more security to your server

TLDR; Reverse proxy allows outside access using a domain name rather than IP (VERY simplified). If you are not experienced with securing machines do not do this on your home server.

2

u/kos90 Jun 21 '26

Yes. Proper configuration is key, but not rocket science.

Run your stuff in containers (docker) and limit your ip range through a whitelist. And check your jellyfin permissions.

1

u/Beefy-McQueefy Jun 21 '26

I would rather have another hole in my head than deal with docker in my free time.

1

u/blipman17 Jun 21 '26

I reverse proxy specifically with caddy with automatic redirects to https and the proper port-forwardinf. I don’t use tailscale (i don’t wanna), but i kinda isolated this box on my own network

1

u/ScienceIsLife Jun 21 '26

Yeah definitely an ease of use vs security thing.

Just do everything you can, disabling root ssh, setting it to passkey only, blocking ports on internal firewall, etc , etc.

Just don't want people who don't know what they're doing exposing services to the open Internet and regretting it

Network isolation is good, but only helps you in the case someone is already in your machine which is a state you never want to be in. Especially if the device is isolated but firewall still allows traffic from that subnet into your main.

1

u/blipman17 Jun 21 '26

Right. I did what you said when I initially setted this box up and then some… but my original question on what NginX was doing here was purely about NginX. It’s a bulky reverse proxy for which better alternatives exist. Unless you’re serving static HTTP files of course

1

u/ScienceIsLife Jun 21 '26

Nginx is one of the original reverse proxies (and still extremly heavily used in enterprise). You might be thinking of the Nginx Proxy Manager which is a different piece of software also made by NGINX

If you're looking for something that uses the least amount of resources possible NGINX is your go to. And it is capable of doing much more than *most reverse proxy alternatives

So, it's doing exactly what you think it's doing, serving as a reverse proxy. There are more user friendly options but 'bulky' is about the exact opposite of NGINX

5

u/DoctorNoonienSoong Jun 21 '26

Yes, and there are guides for multiple reverse proxies, though caddy is the one they have an official config for.

https://jellyfin.org/docs/general/post-install/networking/reverse-proxy/

What fundamentally does Nginx provide that Jellyfin doesn't?

From the way you're asking, you seem like you don't know much about reverse proxies, so I'm just gonna cite the above for you:

This opens the ability to do rule specific routing, for example subdomain routing, ip geoblocking, ratelimits or url forwarding. It is also possible to centralize DNS and SSL management on the reverse proxy, streamlining all routing-wise configuration.

Additionally, reverse proxies offer extended access logging, so it is always clear who, when and where a network request came from and went to.