Please take this discussion to this post: https://lemmy.ml/post/28376589

Main content

Selfhosting is always a dilemma in terms of security for a lot of reasons. Nevertheless, I have one simple goal: selfhost a Jellyfin instance in the most secure way possible. I don’t plan to access it anywhere but home.

TL;DR

I want the highest degree of security possible, but my hard limits are:

  • No custom DNS
  • Always-on VPN
  • No self-signed certificates (unless there is no risk of MITM)
  • No external server

Full explanation

I want to be able to access it from multiple devices, so it can’t be a local-only instance.

I have a Raspberry Pi 5 that I want to host it on. That means I will not be hosting it on an external server, and I will only be able to run something light like securecore rather than something heavy like Qubes OS. Eventually I would like to use GrapheneOS to host it, once Android’s virtual machine management app becomes more stable.

It’s still crazy to me that 2TB microSDXC cards are a real thing.

I would like to avoid subscription costs such as the cost of buying a domain or the cost of paying for a VPN, however I prioritize security over cost. It is truly annoying that Jellyfin clients seldom support self-signed certificates, meaning the only way to get proper E2EE is by buying a domain and using a certificate authority. I wouldn’t want to use a self-signed certificate anyways, due to the risk of MITM attacks. I am a penetration tester, so I have tested attacks by injecting malicious certificates before. It is possible to add self-signed certificates as trusted certificates for each system, but I haven’t been able to get that to work since it seems clients don’t trust them anyways.

Buying a domain also runs many privacy risks, since it’s difficult to buy domains without handing over personal information. I do not want to change my DNS, since that risks browser fingerprinting if it differs from the VPN provider. I always use a VPN (currently ProtonVPN) for my devices.

If I pay for ProtonVPN (or other providers) it is possible to allow LAN connections, which would help significantly, but the issue of self-signed certificates still lingers.

With that said, it seems my options are very limited.

  • The 8232 Project@lemmy.mlOPEnglish
    11·
    6 days ago

    Alright, I’m slowly learning, bare with me here:

    • ProtonVPN is always-on and blocks connections without VPN
    • Jellyfin and Headscale are hosted on the Pi (or does Headscale need its own server?)
    • Tailscale and a Jellyfin client are installed on the phone

    Then:

    • Will that will run fully on the LAN?
    • Will it be encrypted during transit?
    • Does ProtonVPN need to allow LAN connections?
    • just_another_person@lemmy.worldEnglish
      22·
      6 days ago

      Okay, so you might be unfamiliar with networking, so maybe some extra confusion there. Let me try to explain that a bit.

      The Jellyfin server runs on LAN like normal. No need to use Tailscale if you’re just using your Wi-Fi or Ethernet.

      Tailscale/Headscale creates it’s own VPN network which will need its own IP space. Same as any other VPN. It’s just a setting in the config, and the routing is pretty simplistic and mostly automatic.

      Tailscale/Headscale can run anywhere. Doesn’t need to be on that Pi, but that Pi will need a Tailscale client to be on the “Tailnet” and communicate with other devices also connected to it.

      ProtonVPN clients have their own IP space and network that go elsewhere. That’s its own separate thing.

      • The 8232 Project@lemmy.mlOPEnglish
        1·
        6 days ago

        Okay, so you might be unfamiliar with networking

        I’m familiar with some parts of networking, but selfhosted VPNs are something I am unfamiliar with, so thank you for helping me out!

        No need to use Tailscale if you’re just using your Wi-Fi or Ethernet.

        I want it to be encrypted during transit, even if it is over the LAN.

        Tailscale/Headscale creates it’s own VPN network which will need its own IP space.

        This is what I was afraid of, because this means it probably can’t run alongside ProtonVPN, since it would fill up the VPN slot on Android, right?

        If so, it means we’ve come full circle. Unless there is a way to use Tailscale alongside ProtonVPN or a way to get Jellyfin clients to trust self-signed certificates, I don’t see any other option than buying a domain and exposing the server to the internet. Am I missing something?

        • just_another_person@lemmy.worldEnglish
          32·
          6 days ago

          No, it can run along anything, as long as you don’t conflict the IP space assigned to a VPN. It creates it’s own IP network space when running, so just don’t overlap with your other VPN software. Using it while at home is a bit wasteful on effort and power, but just use the Jellyfin LetsEncrypt setup and it’s the same thing.

          You are missing a lot here. I think you’re confused on the difference between your LAN security, and how that fits into network connections. You don’t need an SSL cert to say that something is secure, that’s just one method of PUBLICLY securing something. Every connection on Tailscale is secure end-to-end, so if you run it on your Pi, any client that can connect to it is secured. No open ports, no lapses in security. The encryption happens between each client and the server. You’re secure.

          • The 8232 Project@lemmy.mlOPEnglish
            4·
            6 days ago

            No, it can run along anything, as long as you don’t conflict the IP space assigned to a VPN.

            I tried Tailscale on Android, and it isn’t working because it requires the active VPN slot occupied by ProtonVPN.