Jellyfin/Plex? Walking the line on getting banned.

I don’t run JF or any parts of the *arr stack, so legal/shady video content isn’t a concern. I do stream my private/physical audio collection via Navidrome I’ve been amassing for decades all converted out to flac. I mean, from Cloudflare’s standpoint, I think it’s reasonable and understandable.

Very nice site set up man. Looks like a lot of good info and a lot of work involved. I too use Authelia as an added security step. I have your site bookmarked and will peruse it’s contents in a bit. Thanks for sharing.

Ok cool. I was just curious. I think you’re the first I’ve heard with this situation so it piqued my interest.

I didn’t realize how overwhelming this would be, the amount of information is incredible.

Speaking from experience, it was quite overwhelming to me at first as well. It took me a handful of tries to wrap my head around Cloudflare Tunnels/Zero Trust. I persisted tho, and succeeded. It doesn’t help much that Cloudflare keeps rearranging their site, making it difficult to find necessary information. I will say, that when I migrated to a new server recently, it was a snap and everything clicked in place. There was no need to set up anything on their side. As I remember, it was a matter of a one liner code sequence they provided, to install the necessary components on my server. Jack’s a doughnut, Bob’s your uncle.

I’ll have to say it has been decades since I’ve seen an ad show up on my screen. However, as I said, I do not run the *arr stack or JF, so my experience might not be applicable to everyone.

So, you stream a video using JF or other and you are getting ads show up? Like pre-roll ads, or other? That just sounds weird to me. Could you provide a screen capture of said intrusions?

I cannot get these type of homepages except to have done a thing and feel happy about it.

There is much merit in doing a thing if only for the experience of doing it.

that thing in between my ears

Yes, well, some of us have dented brains. Plus I like a good UI. I’d rather just click an icon.

I’ve been using Homarr for quite a while, and I can’t say as I have any complaints. It does have integrations, tho if you want to go nuts with that, Homepage would probably be a better fit. It’s a pretty straight forward app and it’s very pleasing to the eyes.

Nice dashboard OP. Very clean

I don’t have a definite answer for that. I don’t stream video through Cloudflare.

Well, I don’t run the *arr stack or JF, so I cannot comment to your issue.

Well, to cut through the FUD, we’ll have to look at the operative words which are: ‘disproportionate percentage of pictures, audio files, or other large files’. It’s not saying, you can’t stream a video or some audio, or look at your pictures. So, yeah, I think I’m good, and if it does happen, drop back to option 2. No biggie.

Dokuwiki, from what I’ve heard and read, is a great package. If it weren’t for seeing Ingis at selfh.st, I would have gone with Dokuwiki. As it so happened, I figured I’d give Ingis/Obsidian one last shot. If I were serving up documents to the public, I would think Dokuwiki would be ideal.

Like I said, if you’ve hooked up 20 of your best buds to your JF, then yeah they’d probably have an issue with that. Personal use, I doubt they’d care really.

The 4790 will always have a special place in my heart 😂

I was actually pleasantly surprised. I had two Dell T320, which are good too, but put out a lot of heat, and cost about $40 USD/month to run. So I decommissioned one, and am now looking to purchase an additional 7020 and decommission the other T320. Don’t know what to do with the T320s tho. Nobody on ebay would be willing to pay what it cost to ship a boat anchor. The money I’ll save in electricity costs will more than cover the price of admission.

Dell Optiplexe

Picked up a 7020 with the i7-4790 for $125 + an additional $50 USD for 32 GB RAM. I’m running 52 containers on it, and it doesn’t break a sweat. Plus, it costs about $8 USD in electricity. Winner Winner Chicken Dinner.

I bailed on DocuWiki in lieu of Ignis. It’s Obsidian but without the need for VNC that the LinuxServer edition had incorporated. I’ve always liked the way Obsidian is set up, but I didn’t like the fact that I had to access it via VNC. To make a note in the LinuxServer edition, you had to paste it into VNC and then paste it into Obsidian, which was rather awkward.

I tried this a long time ago. My conclusion was that there is not really a way to install Linux on the Xbox One. There have been reports that have run Linux inside of a jail/VM, but things don’t seem to mesh correctly like network connectivity. There is a whole hacking and modding the boot chain. I gave up. LOL

Perhaps there has been progress since I last tried. Also, very possible, I didn’t have the skills to pull it off. Perhaps someone else will chime in.

What are your concerns about Cloudflare and getting ‘banned’? There used to be a clause in the TOS that prohibited streaming video. However, as one user here has pointed out, that has been since superseded. Now, I’m not going to tell you that you can share your JF with 20 other users and not raise an eyebrow with Cloudflare. I don’t have a clue what they would do in that case. As far as streaming, I run Navidrome around the house from the time I get up in the morning, until I go to bed at night, and have had no issues. There also isn’t a bandwidth cap that I can find anywhere in Cloudflare’s documentation.

Yes VLANS. Server is on one, PC is on one, My lady friend gets one because when she comes over, she gets grumpy if she doesn’t see a wall of advertisements…especially her VLAN. LOL

This is the security I’ve implemented on my network:

• Modem receiving IP from ISP. Modem to router. Router to stand alone pfsense firewall. Router has a 54 character complex password for WiFi. There are no guest provisions for WiFi.
• Pfsense firewall with pfblockerng & suricata running on both lan and wan, both with a full array of rules/feeds updated daily. pfsense has tailscale as an overlay vpn. Server traffic and PC traffic have their own VLAN provided by pfsense. My approach is to deny all until something complains and address that on a case by case basis. Additionally ntopng is utilized for traffic analysis. IPv6 is disabled.
• Server running Tailscale as an overlay VPN, UFW deny all posture, and fail2ban with an aggressive posture. Server has been hardened against Lynis spec where applicable. Not all recommendations apply to my server. Server is utilizing host deny/host allow and SSH keys.
• Server is utilizing containers for services.
• Server is using Cloudflare tunnel/zero trust.
• Server and pfsense communicate via Tailscale encrypted tunnel. PC/Phone/mobile device can communicate with pfsense via Tailscale.
• Server services are accessed via https.
• PC connected to pfsense firewall with same rules as server. PC is using a VPN with Cloudflare 1.1.1.1/1.0.0.1 for DNS queries. Firefox is using 1.1.1.1/1.0.0.1. Settings for Firefox are the strictest for Enhanced Tracking Protection, and DOH. HTTPS-Only mode enabled. PC is also running a soft firewall.
• All other devices such as phones, laptops, and tablets run a VPN with Cloudflare 1.1.1.1/1.0.0.1 for DNS queries.
• IoT devices are isolated. Phones are isolated. Smart TVs are isolated.

I’ve been told repeatedly that I go overboard on security.

Do you guys just enjoy cybersecurity?

To the extent of my knowledge thereof, yes.

Do you actually keep sensitive data on your self hosted systems?

No I do not. No password vaults, no financial info, etc.

Do you self-host on expensive hardware?

No. In fact I just finished decommissioning one of my Dell T320s. In it’s place I put an Optiplex 7020 SFF. The Dell T320 was adding $40 USD of my electric bill, while the Optiplex 7020 sips about $8 a month, plus it doesn’t pump heat in to the lab like the T320s do. I have one more T320 to decommission and then I’ll be done with that type of equipment. I’m looking to sell the two T320s, but I’m not sure someone wants to pay to ship a boat anchor.

It’s not that the data on my server is so sensitive. I just don’t want anyone mucking around in my lab all willy nilly, which is why I run all the above and isolate everything I can, so that anyone who might get through, wouldn’t have any lateral movement,