Please take this discussion to this post: https://lemmy.ml/post/28376589

Main content

Selfhosting is always a dilemma in terms of security for a lot of reasons. Nevertheless, I have one simple goal: selfhost a Jellyfin instance in the most secure way possible. I don’t plan to access it anywhere but home.

TL;DR

I want the highest degree of security possible, but my hard limits are:

  • No custom DNS
  • Always-on VPN
  • No self-signed certificates (unless there is no risk of MITM)
  • No external server

Full explanation

I want to be able to access it from multiple devices, so it can’t be a local-only instance.

I have a Raspberry Pi 5 that I want to host it on. That means I will not be hosting it on an external server, and I will only be able to run something light like securecore rather than something heavy like Qubes OS. Eventually I would like to use GrapheneOS to host it, once Android’s virtual machine management app becomes more stable.

It’s still crazy to me that 2TB microSDXC cards are a real thing.

I would like to avoid subscription costs such as the cost of buying a domain or the cost of paying for a VPN, however I prioritize security over cost. It is truly annoying that Jellyfin clients seldom support self-signed certificates, meaning the only way to get proper E2EE is by buying a domain and using a certificate authority. I wouldn’t want to use a self-signed certificate anyways, due to the risk of MITM attacks. I am a penetration tester, so I have tested attacks by injecting malicious certificates before. It is possible to add self-signed certificates as trusted certificates for each system, but I haven’t been able to get that to work since it seems clients don’t trust them anyways.

Buying a domain also runs many privacy risks, since it’s difficult to buy domains without handing over personal information. I do not want to change my DNS, since that risks browser fingerprinting if it differs from the VPN provider. I always use a VPN (currently ProtonVPN) for my devices.

If I pay for ProtonVPN (or other providers) it is possible to allow LAN connections, which would help significantly, but the issue of self-signed certificates still lingers.

With that said, it seems my options are very limited.

  • just_another_person@lemmy.worldEnglish
    122·
    6 days ago

    Run in at home and get Tailscale setup with a Headscale server, or just use Tailscale straight out of you want. That’s the simplest.

    A better option would be getting an OpenWRT router and start building proper infrastructure for doing something like this. You’ll have many different options for decentralized and NAT traversing VPNs with this option. GL.Inet Flint is a great choice.

    • The 8232 Project@lemmy.mlOPEnglish
      11·
      6 days ago

      Run in at home and get Tailscale setup with a Headscale server, or just use Tailscale straight out of you want. That’s the simplest.

      I have no idea how to do this. Do you have any resources? Does it cost a subscription fee?

      A better option would be getting an OpenWRT router

      This is what I have planned. OpenWrt Two my beloved

      You’ll have many different options for decentralized and NAT traversing VPNs with this option. GL.Inet Flint is a great choice.

      I also don’t know how to do this. Resources are much appreciated :)

      • just_another_person@lemmy.worldEnglish
        21·
        6 days ago

        Okay, so let me explain a bit:

        Tailscale is a commercial client that is semi-FOSS. It’s built on Wireguard, which is FOSS, but the cloud hosted architecture does cost money after I think 5 clients.

        Headscale is a FOSS implementation of Tailscale, and totally free to host, skipping the above.

        Tailscale itself is super easy to use, and you just install it on a node, register it, and then it has access to any other device on that secured network. So if you install it on your Jellyfin machine at home behind your normal firewall, then install it on your phone, you’ll be able to connect to it without forwarding ports for messing around with much.

        It should be that simple.

        • sem@lemmy.blahaj.zoneEnglish
          1·
          6 days ago

          Iirc it supports 100 clients on the free tier, but even that is a soft limit – I’ve heard that they will accommodate more devices if you ask (and you’re in a non-commercial setting)

        • The 8232 Project@lemmy.mlOPEnglish
          11·
          6 days ago

          Does Headscale conflict with ProtonVPN/Mullvad VPN (i.e. can I use those alongside Headscale)? Android has a limited number of VPN slots, so that’s why I ask.

          • just_another_person@lemmy.worldEnglish
            41·
            6 days ago

            Nope. Wireguard runs outside the same protocols.

            Just give Tailscale a try first because it’s essentially free for a few nodes. If you need more and don’t want to pay, then investigate Headscale.

            • The 8232 Project@lemmy.mlOPEnglish
              13·
              6 days ago

              So:

              • ProtonVPN is installed on my Android phone
              • Android has Always-on VPN enabled
              • Android has Block connections without VPN enabled
              • Host Jellyfin on my Raspberry Pi 5
              • Install Headscale on my Raspberry Pi 5
              • Install Headscale on my Android phone
              • Install a Jellyfin client on my Android phone
              • Configure everything

              And that will work? It will be encrypted during transit? And only run on the LAN? Does ProtonVPN need to allow LAN connections (I assume it does)?

              • just_another_person@lemmy.worldEnglish
                22·
                6 days ago

                Sorry, it may be confusing, but Headscale is ONLY the free server component. The client is still Tailscale’s open client. That’s why I’m saying just sign up and try it first with Tailscale, and then if you need more connections without paying, create a Headscale server and re-register your clients to that to skip charges.

                • The 8232 Project@lemmy.mlOPEnglish
                  11·
                  6 days ago

                  Alright, I’m slowly learning, bare with me here:

                  • ProtonVPN is always-on and blocks connections without VPN
                  • Jellyfin and Headscale are hosted on the Pi (or does Headscale need its own server?)
                  • Tailscale and a Jellyfin client are installed on the phone

                  Then:

                  • Will that will run fully on the LAN?
                  • Will it be encrypted during transit?
                  • Does ProtonVPN need to allow LAN connections?
                  • just_another_person@lemmy.worldEnglish
                    22·
                    6 days ago

                    Okay, so you might be unfamiliar with networking, so maybe some extra confusion there. Let me try to explain that a bit.

                    The Jellyfin server runs on LAN like normal. No need to use Tailscale if you’re just using your Wi-Fi or Ethernet.

                    Tailscale/Headscale creates it’s own VPN network which will need its own IP space. Same as any other VPN. It’s just a setting in the config, and the routing is pretty simplistic and mostly automatic.

                    Tailscale/Headscale can run anywhere. Doesn’t need to be on that Pi, but that Pi will need a Tailscale client to be on the “Tailnet” and communicate with other devices also connected to it.

                    ProtonVPN clients have their own IP space and network that go elsewhere. That’s its own separate thing.