- cross-posted to:
- piracy@lemmy.dbzer0.com
- cross-posted to:
- piracy@lemmy.dbzer0.com
We are also changing how remote playback works for streaming personal media (that is, playback when not on the same local network as the server). The reality is that we need more resources to continue putting forth the best personal media experience, and as a result, we will no longer offer remote playback as a free feature. This—alongside the new Plex Pass pricing—will help provide those resources. This change will apply to the future release of our new Plex experience for mobile and other platforms.
My home connection is behind cgnat so I got a free VPS from oracle (provides a public ip address), install caddy on VPS, install tailscale on VPS and router, expose routes from LAN to tailscale network.
Now you can use caddy to expose, for example, a docker container (jellyfin) at 192.168.1.100 to subdomain.exampledomain.com with ssl cert provided by caddy.
VPS also requires some other stuff like ddclient and fail2ban.
I pieced this all together myself… it’s doable if you spend some time reading.
That exposes Jellyfin to the internet
Yes exactly. What do you think plex is doing?
Using a relay server to separate online from home connection
I don’t see anything in the linked article about a relay server
No, the article only mentions the feature by name, the docs for the feature mentions the relay https://support.plex.tv/articles/216766168-accessing-a-server-through-relay/
I see. So if you read that instruction you’ll see it’s the exact same setup that I outlined. They use a vpn to connect your client to your server and just negotiate the meeting in the middle. It’s the exact same risk scenario as running a reverse proxy on your own vps. Unless I’m missing something else?
You are, authentication on the VPS, you’re relying on Jellyfin authentication against the internet. Correct me if I’m wrong, but this is your suggested setup: [home server] Jellyfin -> [remote server] Reverse Proxy -> [remote machine] users. Let’s imagine a scenario where Jellyfin has a bug that if you leave the password empty it logs you in (I know, it’s an exaggeration but just for the sake of argument, an SQL injection or other similar attacks would be more plausible but I’m trying to keep things simple), on your setup now anyone can log into your Jellyfin and from there it’s one jump to your home server. On Plex’s solution even if Plex authentication gets compromised the attacker only got access to the remote server, and would now need to find another vulnerability to jump to your Plex at home.
Putting something like Authelia/Authentik on a VPS in front of Jellyfin is a similar approach, but the Jellyfin client can’t handle third party authentication AFAIK
My interpretation of your linked instruction (granted, I haven’t tried plex) is that it’s the same two scenarios.
Your plex client app login talks directly to your server login. The client app meeting the server is arranged by the plex relay server and nothing more. There is no ‘logging in’ to the plex relay server; it’s function is to arrange a meeting of two tunnels and that’s it, much like a tailscale derp server.
The relay server is serving the same function as caddy on a VPS, hell, they could even be using tailscale under the hood and it’d look exactly the same to a user.
Anyway, attack vectors even with a public facing jellyfin are mitigated because
a) jellyfin is running in a docker container = a successful attacker would only be able to trash my jellyfin container, which ultimately is not that big of a deal (unless there is a different docker exploit that enables access to the server itself, which is an entirely different issue and larger than a jellyfin/plex discussion)
b) fail2ban in conjunction with a reverse proxy bans malicious ip addresses that come back with too many errors too many times (errors that you, the admin, specify) So, for example, brute force login attacks are mitigated.
c) the reverse proxy itself allows access to only one specified internal ip address/port combination. Pending a caddy exploit (again, a different discussion) it is not possible to fish for acrive ip addresses or port scan my internal network.