I have docker installed, but only have a vague idea of how it works.
Back in the day, I would just port forward, but even then, I would need a static IP somehow.
I have heard a reverse proxy is an option, but that is an entirely new topic to me.
Surely there is an easy way to access Jellyfin outside of my home network that I’m just missing.
https://netbird.io/ for your own private network of trusted devices, it’s free and doesn’t require a separate Big Tech account to use (unlike Tailscale)
And then if you want to share Jellyfin with someone who isn’t in your Netbird network… believe it or not, also Netbird
Tailscale has an option for OIDC. That should be avoiding the tech mafia enough no?
This
is this much different than nginx?
Yes, it is easier and safer for someone who doesn’t know what they are doing to set up.
Does it work with a reverse proxy?
It has functionality to let you set up a reverse proxy (in beta). But you can access all your services by using the zero trust vpn
Nice! Maybe I’ll try the beta. Been wanting to tinker around with my set up recently
An easy way? I guess the term ‘easy’ depends on your expertise with networking, firewalls, etc. Sounds like you and I are at about the same level there. In which case the answer is: no, there’s no easy way from what I can tell. I’ve looked into it and it’s a lot more involved than, say, Plex (because Plex does a bunch of the routing and stuff for you, but at a cost).
Tailscale is incredibly easy. Install, start, sign in on both devices. Boom. Jellyfin from anywhere
I’m sold! Setting it up now!
Let me know if you have any trouble!
That is the answer my intuition was leading me to, but I hoped I was wrong. It looks like this is an opportunity to learn something outside of my comfort zone.
consider zerotier or tailscale
There are things like duckdns if you cannot get a static IP, but there are also things like wireguard.
That’s the whole point of a domain. Your IP changes every now and again you need people to know where to reach you. You give them a domain, and you configure the name records so that the domain always points to the right IP address.
Your options:
- dynamic IP - you keep your setup as is and just periodically tell them the new IP you’re on. Annoying and exposed
- static IP - you buy a static IP (from your ISP) and share it with your friends once. A little bit less annoying and still exposed
- you use a VPN like hamachi or radmin - your friends install the software, they look for you IP in there, you’re done - very secure but also very annoying
- you buy a domain - you have to configure an IP updater like ddclient or similar, then you jellyfin should be reachable - least annoying for your friends but also slightly less secure
Domain is the cleanest option.
I am telling you how annoying it is because that’s how likely your friends are to adopt it and how secure it is because depending on your country you are doing something illegal and you really don’t want anyone to find out and you gotta keep it updated more often if you don’t want people to exploit it. There’s an endless supply of very smart people out there who use known bugs to target public services.
I appreciate your response!
It looks like a VPN is the option I’m leaning towards, but I’ll definitely put the idea of buying a domain in my back pocket for a while.
Some .xyz domains cost less than 1$. Mine is 0,85$/year
What do you do, randomise it every year?
Nah same domain, 0,85$/year. It’s 8 numbers + .xyz
Wow thanks!! I’ll use a different amount of numbers or something
You get to pick your numbers
On June 1, 2017, .XYZ launched the 1.111B class .xyz domains, cheap domains priced at US$0.99 per year and renewed at the same price. The class of domains consists of six-, seven-, eight-, and nine-digit numeric combinations between 000000.xyz and 999999999.xyz. Daniel Negari, CEO of .XYZ, stated that it was meant to bring competition, choice, and innovation to the market
Thank you. I’ve bought a domain. I’d like to go with this option. Just researching how to do it on cloud flare
On Cloudflare, you’ll want to set a DNS record to point any relevant subdomains to your current WAN IP address. IPv4 will be an A Name record. IPv6 would be an AAAA Name record, but I’m not going to deal with IPv6 for this… Here is an example of mine, with info blocked out:
So for instance, maybe you have a
peepee.example.comsubdomain, apoopoo.example.comsubdomain, etc which all point to your WAN IP address. That will basically tell Cloudflare’s DNS to forward any traffic for those subdomains to your WAN IP. Each subdomain can also choose whether or not to proxy the content, or just directly send it to your WAN with DNS. Basically, when Cloudflare propagates the DNS records to the various DNS servers, you can choose whether that record has your WAN IP (DNS Only) or one of Cloudflare’s (Proxied). Proxy support means you can take advantage of some additional CF protections, but it also means passing all of the data through CF’s server. In most cases, you’ll want DNS Only. Proxy support will depend on the individual service. Some will work fine with it, some won’t. And it’s also possible that you don’t want services proxied through CF for privacy reasons.Next, you’ll want to set up a reverse proxy service. This will be something like Nginx Proxy Manager, Caddy, etc that you run on a device on your LAN. It can even be on the same machine running your various services. The big reverse proxies all offer Docker images, so you can incorporate it directly into an existing Docker stack if you already have one. Personally I use NPM, but Caddy is also very popular.
You’ll tell this reverse proxy “when you receive valid traffic addressed to {subdomain}, forward it to {relevant service on your LAN}.” You can also set some additional options for each subdomain, like automatically upgrading to https. For instance, maybe
peepee.example.comforwards to192.168.1.100:42069on your LAN, and is configured to automatically upgrade any http traffic to https, and to require https.You can also set up automatic TLS certificate renewal, so https traffic can be properly encrypted. The reverse proxy will need an API key, and it will allow the service to automatically check expiration dates and pull a fresh TLS cert for your domain if the date is coming up soon.
You’ll probably want to use a wildcard certificate, (basically
*.example.com) because the TLS certificates are open to the public. So if you do individual certs for all of your various services, bots will scrape the public records and you’ll inevitably get a lot of bot traffic probing your various subdomains. A wildcard domain usually means the bots hit the standardexample.comandwww.example.comfirst, which makes them super easy to detect and block. I even have rules set up to automatically block anything that tries to access my www subdomain, because I specifically don’t host a landing page and don’t have anything available there. So I know that any traffic hitting that www subdomain is a bot trying to access common subdomains.Next, you’ll want to forward ports 80 and 443 to your reverse proxy. Port 80 is the standard port for http traffic, and 443 is the standard port for https traffic. These will be the ports that your reverse proxy actually receives the traffic on, before forwarding it to the various services. Note that lots of lazy devs default to using 80 and 443 for lots of things, so you may want to configure your router to use a different port (like 81 or 444) for its config page if you’re able. Otherwise, you may end up accidentally locking yourself out of your router’s config page, because it will attempt to use 80 to reach the page, then get automatically forwarded to the reverse proxy instead.
Finally, for some ease-of-maintenance, you may want to consider adding a DDNS service (like Cloudflare-DDNS) to your docker stack. This will occasionally check your current WAN IP, and update it with Cloudflare if necessary. For example, if you have an outage and your router gets a new WAN IP when it boots back up again. Normally you would need to manually go to Cloudflare and update the IP info to point at your new address. But DDNS does that automatically.
The way traffic flows when it is all set up is along these lines:
- A device wants to access your service at
peepee.example.com. It doesn’t know where to find that site, so it asks a DNS server. - Cloudflare has told all of the various DNS servers “hey,
peepee.example.comcan be found at {your IPv4 WAN address}”. - The device follows that DNS record, and attempts to connect to your IPv4 WAN address, on port 80 or 443. For this example, let’s say it tries to connect on port 80 for standard http traffic. The device knocks on port 80’s door and says “hey, I’m here to access
http://peepee.example.com/.” - Your reverse proxy checks the configured list, finds the valid
peepee.example.comsubdomain, finds it has a valid TLS cert, finds it is configured to automatically upgrade to https, and responds “Yes, please upgrade to https. Http traffic is not allowed.” - The external device knocks again, this time on port 443’s door. It goes “hey, I’m here to access
https://peepee.example.com/. Your reverse proxy goes “thank you, here is the TLS cert and my half of the TLS security handshake.” - Your external device uses the data in the TLS cert to validate and complete the TLS handshake with the reverse proxy, and the traffic between the reverse proxy and your external device is now encrypted with https. Your device gets the nice little “secured” padlock icon in your browser. Because the traffic is encrypted, a malicious actor may be able to tell what kind of info you are passing (for example, a video stream will likely have a pretty obvious pattern) but they won’t be able to see what specific data you are passing. They may be able to tell that you’re streaming a video, but they won’t know which video specifically.
- The reverse proxy forwards the traffic to the service, configured at
192.168.1.100:42069. - Your service does not ever know the device is being accessed via WAN, because (as far as the service can tell) the traffic is coming from your reverse proxy (also a LAN device). So any “pay to use WAN” services will continue to work for free.
- The external device never gets access to info like the specific LAN IP or port number, because it only has access to the reverse proxy. All of the traffic is passing back and forth between the reverse proxy.
But notably, keep in mind that the reverse proxy didn’t do any actual user authentication. If your service has a weak password, a reverse proxy will act as a gateway for any potential hackers to gain access to the service. The same way an open port is a gateway directly to the service, the reverse proxy is now a gateway that simply requires an attacker to use a subdomain instead of an IP and port number. And if you make your subdomain something like
jellyfin.example.comit will probably be dead simple for a bot to guess. And any vulnerabilities in the service will still be exploitable via the reverse proxy, because the reverse proxy is simply making sure the request is valid, and then passing the traffic back and forth. It isn’t actually inspecting the content of that traffic, so it’s not going to stop things like attackers. When you hear digital security folks talk about things like attack vectors, this is what they’re referring to. Your reverse proxy is a potential vector of attack for your configured services. Use strong passwords, keep your services updated, etc…You can technically add authentication to a reverse proxy. So for instance, maybe a service doesn’t have any built-in way to add a password. You can have the reverse proxy act as an authentication gate, so it will prompt the user for a username+password before they can even reach the service. This will make the services more secure (yes, even the ones that already have passwords, as long as you use a different password for your reverse proxy authentication) but it will break most apps that are designed to work with a service. For instance, Jellyfin has several apps that work, but those apps won’t have any way to get past the reverse proxy’s password gate. So those apps will simply break if you add a second layer of authentication with your reverse proxy.
There are also some security options you’ll likely want to enable on Cloudflare’s side, but this comment is already long enough.
Thank you so much for such a detailed reply. I’m going to print this off and go through it point by point.
I didn’t realize how overwhelming this would be, the amount of information is incredible.
I was trying to use the cloud flare ai assistant to set up WARP access to my phone but then I realized its basically another VPN which defeats the whole point on me using the domain because I wanted to be able to use my traditional VPN to stay protected.
I also wanted to be able to log into my server android apps like immich and Joplin but can’t do that with authentication as its not a webpage.
I’ll print this off and anything I don’t understand (most of it at this stage haha) I’ll spend some time studying it.
I got a good laugh at peepee poopoo
Thanks again
I actually just updated it slightly, and may continue to do so if I think of things. So you may simply want to check back here instead of printing it.
I didn’t realize how overwhelming this would be, the amount of information is incredible.
Speaking from experience, it was quite overwhelming to me at first as well. It took me a handful of tries to wrap my head around Cloudflare Tunnels/Zero Trust. I persisted tho, and succeeded. It doesn’t help much that Cloudflare keeps rearranging their site, making it difficult to find necessary information. I will say, that when I migrated to a new server recently, it was a snap and everything clicked in place. There was no need to set up anything on their side. As I remember, it was a matter of a one liner code sequence they provided, to install the necessary components on my server. Jack’s a doughnut, Bob’s your uncle.
Yeah I’ve noticed that. A lot of the tutorials for learning cloudflare are with older GUI
- A device wants to access your service at
You left out DDNS. It’s free, easy to set up with lots of detailed guides online, and works as well as a static IP.
I added a reference to your comment
yeah I forgot that one. I had to rush the comment a bit.
You don’t need a static IP, you just have to keep track of what your current dynamic IP is.
You can do this with either a free or a paid DNS service.
There are a few different ‘free dns’ services that will delegate a subdomain of theirs to you at no cost. Admittedly, I’ve never actually used one of these so their names escape me. Hopefully someone else can point one of those out if that’s what you really want.
I purchased a domain via google domains, when they existed. It’s now transferred to squarespace, because they bought out google domains a few years ago.
It was around $13/year when I first got it a decade ago. It’s now around $28/year.
This allows me full control over the domain: I can use as many subdomains as I want to give each service I use it’s own unique name. (Instead of using their own separate ports that you’ve gotta remember) My domain will also forward all inbound email to my gmail account; this lets me use email addresses like <servicename>@mydomain.example. This way, I don’t share my real email and can immediately tell who sold my info to the highest bidder when I get spam. (I could also host my own email service if I really wanted, but I haven’t bothered)
Add Cloudflare ontop (for free); and it can filter out known attacks, ddos attempts, geofence your services to regions you’ll actually be in, provide/autorenew ssl certs for https, show you usage analytics, cache static data reducing server/network load, etc.
Ultimately, the paid option is well worth it IMO.
You don’t need a static IP, you just have to keep track of what your current dynamic IP is.
You still need a public IP address. More and more often, IPv4 services are provided behind CGNAT, which won’t be able to work as you describe.
If you don’t have a public IPv4 for your LAN you can use IPv6. Or, you can reverse proxy your services through a gateway with a public IPv4.
I use a a reverse proxy (Pangolin) running on a VPS. A Newt tunnel connects my LAN to to Pangolin, exposing my local services via subdomains.
/edit; vpns are good and all, but they require you to setup software on the remote device to connect to it, and that typically routes most if not all your traffic back to the vpn server then out to the internet. That can create speed/bandwidth issues.
Tailscale, ZeroTier, and other similar services generally establish direct tunnels between devices, without a separate VPN server. They use a central service merely as a sort of common meeting point (STUN/TURN) for the devices to figure out how to establish direct tunnel(s).
Fair points.
I’ve been lucky enough to have never been behind cgnat, so I keep forgetting about it.
My bigger concern with tailscale is being required to install software on the client. Not every device I use, I have permission to install a vpn client, nor would I want to.
For example, I have a fileshare using Filebrowser where I store work related files that I don’t want to loose access to or need access to from multiple machines (non proprietary info, stuff IT/MGT wouldnt get mad at me for ofc. I’ve actually cleared it with my managers, so no worries). That’s also a handy way to (temporarily) share large files with people or provide a way for friends to upload large files to me.
I also like to access my emby server (using sufficiently limited accounts), from things like the TV in the work break room, or a friends PC while I’m visiting.
Tailscale is a hurdle that I just don’t need/want.
As averse as I am to spending money on subscription services, having my own domain for less than 30 bucks a year might be worth it.
I think I’m going to try out the tailscale VPN route first before I fully warm up to buying a domain.
*Edit-You’ve definitely got me sold on getting a domain! Thank you so much for all the info!
Glad I could help. I’m not always immediately available, but I don’t mind answering questions if you run into troubles. Just send me a DM and I’ll do what I can. :)
As others have said, Tailscale is the most pragmatic solution. It’s a mesh VPN based on Wireguard. It’s implemented in such a way that you don’t need a static IP and don’t need to open any ports on your firewall. The caveat is that you either need to register an account on tailscale.com (it’s free for small-scale use) or set up a self-hosted alternative like Headscale on a VPS. Then you have to install the Tailscale client on each of the hosts you want to access and log into your account.
Tailscale nodes will be accessible using an internal, private address in the
100.64.0.0/8address space. You can also set up a split DNS that allows you to access your hosts using a DNS name likehostname.your-tailnet-name.ts.net.since you’re a jellyfin user I’ll give you the best solution.
expose ports 80, 22, and 3306 of your server to the internet.
better yet, just make a DMZ to your server from the internet.
then you can stream, ssh, and query your database from anywhere in the world.
This is how I would have done it in 2001.
It is my understanding that the only reason to go this route in this day and age is if you prefer to survive off the tears of cybersecurity professionals.
who needs cybersecurity? nothing bad should happen.
Protip: Don’t fucking do this
protip protip:
I’m tired of this same exact question being asked over and over and over again. so every time it’s asked I’m going to tell them to expose everything to the internet.
if you can’t learn to search and solve your own problems you kind of deserve the obtusely wrong answers.
The responses I received were exponentially more helpful than scouring for the information myself.
Everyone here had experience and expertise that I did not, and I had a working solution running on my computer within 10 minutes of asking.
Part of the purpose of a community like this is evident in posts like this.
Your response, though funny, is damaging to the community, and unhelpful at best.
I understand where you were coming from, but please don’t.
The responses I received were exponentially more helpful than scouring for the information myself.
lazy people being lazy.
Everyone here had experience and expertise that I did not, and I had a working solution running on my computer within 10 minutes of asking.
but do you actually understand the solution you used or did you just “follow the recipe”. knowing how to make brownies is nice, but knowing why brownies brownie allow you to make a better brownie.
not saying don’t ask questions, but asking less generic questions help build a stronger community. Questions like, “what are the benefits to exposing jellyfin publicly using tailscale vs just opening ports?” or “how does tailscale protect my private network from attacks when it’s used to expose jellyfin publicly?”
Your response, though funny, is damaging to the community, and unhelpful at best.
can’t be any more damaging than asking the same question 300 different ways because “The responses I received were exponentially more helpful than scouring for the information myself”.
we’re not your LLM agent. we’re not your search engine. we’re a community with experience and opinions. use us for that.
Go back to your Linux forums or whatever dark hole you crawled out of.
Did your mom ever tell you if you have nothing nice to say, don’t say it at all?
Nah, I’m just confused about if this community is about asking the same question over and over or not. maybe it’s about sharing AI generated slop projects instead? nah couldn’t be that either. I know! it has to be the community to shit on anyone who uses Plex!
Did your mom ever tell you if you have nothing nice to say, don’t say it at all?
she did, but then again look at where that got us in the world today.
I bet you don’t even know what the OSI model is.
Lol the OSI model? Weird flex. I am a senior network engineer by trade and manage global routing and security for large companies, so I am definitely familiar.
Then ignore the post. I hope you never need to ask a question to someone as disgruntled as you in the future. What an asshole.
Picture anything you’re not skilled at. You’d probably ask someone who is skilled at said thing about a problem you have. Now imagine them responding to you like this.
Then ignore the post.
hard to do that when this question is posted twice a week.
I hope you never need to ask a question to someone as disgruntled as you in the future. What an asshole.
Woe is me! you know what I do? I use my eyes and brain to read and learn. I search for my question first before wasting the time of others. why do you think that is? probably because you learn more about something by investing time and effort into a topic you’re unskilled at.
Picture anything you’re not skilled at. You’d probably ask someone who is skilled at said thing about a problem you have. Now imagine them responding to you like this.
hard to picture that because when I am unskilled at something I teach myself to be skilled. I do this by reading, observing, and trial & error.
I get it, not everyone is as amazing as I am. But the bar is pretty low since this question has been answered a dozen or more times not only on this community but on hundreds of other communities. there is literally no good excuse to not search for your solution and learn from it.
I built my first PC by myself. no documents. no help. hell it was just after dialup was a “thing”. I burned up a few components in the process. guess what, I taught myself how to fix them too. I went to the library, I read books, took notes, did the things. I learned how to read schematics, I learned how to salvage components, learned a lot.
I think you can too, if you weren’t so lazy looking for the easy answer.
Not everyone has the luxury or capacity to research and learn. So if you have a health problem you self diagnose and give yourself treatment at the hospital? I’m sure those docs get asked about the same problems all the time. And yet, they don’t turn you away because they have seen that problem too many times.
Built my first pc around the same time, and I still researched and asked for clarifications when needed.
I think you just have an issue accepting that others are not in the same situation or as capable as you. Some people have much less free time. Less tolerance for error.
Let’s say your engine costs 25k to rebuild. You’d do that yourself? Sans the labour, 10k in parts. You’re okay with not having a vehicle for potentially months? You’re okay if you happen to misunderstand an instruction or forget something and spend all thy time getting it back together advancing the thing explode when you get it all together?
You seem to think quite highly of yourself. Your comments just reek of narcissism.
Not everyone has the luxury or capacity to research and learn.
bullshit excuses.
So if you have a health problem you self diagnose and give yourself treatment at the hospital?
I can diagnose, I’ve read medical textbooks and have researched. I have even performed minor surgery on myself to remove a cyst from my thigh about the size of a grape. I taught myself how to properly suture for that one. I don’t recommend it though. cyst’s can actually wrap around blood vessels which when burst or cut can make you bleed out quickly. having a cauterizing tool helps mitigate this. you can DIY with a scalpel and an induction source to heat the tip of the blade (ask me how I know), though most surgeons use electric ones these days that use plasma to burn the flesh away. you can actually buy them for pretty cheap these days.
I’m sure those docs get asked about the same problems all the time. And yet, they don’t turn you away because they have seen that problem too many times.
doctors take a Hippocratic Oath. Tech workers don’t, so your analogy falls flat.
Built my first pc around the same time, and I still researched and asked for clarifications when needed.
good for you. sounds like you had better opportunities than I did. How did you put it? “Not everyone has the same luxury to research and learn.” Sorry, paraphrasing.
I think you just have an issue accepting that others are not in the same situation or as capable as you. Some people have much less free time. Less tolerance for error.
how presumptuous. you don’t have the time or tolerance for making mistakes, so you’re going to waste the time and effort of a community and ask the same question repeatedly? compared with that perspective, I sound less like an asshole. and I am an asshole!
Let’s say your engine costs 25k to rebuild. You’d do that yourself?
of course I wouldn’t! $25k will buy a new car. I only spent $13k on my current car.
Sans the labour, 10k in parts. You’re okay with not having a vehicle for potentially months? You’re okay if you happen to misunderstand an instruction or forget something and spend all thy time getting it back together advancing the thing explode when you get it all together?
I see what you’re trying to do. the difference is, I would be paying a mechanic to fix my car. I’m not asking them how to fix it, or why it needs to be fixed. nobody is paying anyone on this community. maybe that’s the problem. maybe if we charged people to ask questions they might be more inclined to see if the question has been asked already…
You seem to think quite highly of yourself. Your comments just reek of narcissism.
funny! I’m super humble about myself IRL. I don’t talk about myself or my accomplishments at all, except when it comes to shining a light on lazy people who just want the answers spoon fed to them. y’all aren’t babies or children anymore. the internet exists and is a treasure trove of information. think critically, ask yourself more questions than others. reach out when you don’t understand something.
it’s not hard, but I guess it is when your expectation is that people should just help you because you want it.
I only read your first quote. I didn’t realize you had the capacity to be in every persons shoes, ergo have total understanding. If you can’t see how fucked up that is, I’m just arguing with a narcissist and there’s nothing I can do to open your view so I cease my comments here.
If the goal is doing this in a simple fashion, then use Tailscale funnels (https://tailscale.com/docs/features/tailscale-funnel). Funnels automate the process and act as a reverse proxy into specific servers within your tailnet.
The downside is there is no authentication to funnels, so whatever you’re running (Jellyfin in this case so that’s not an issue) needs it’s own authentication setup. You might consider running fail2ban on that machine and have it watch for login attempts, but otherwise that is the simplest setup I think you could do.
Used to have a tool specifically to route my dynamic IP to something static, without buying a domain name, back when I first hosted a website on my own regular home PC as a teen called “No-IP.”
Not sure if it’s still a thing.
Free ones are less common now (no-ip went paid.) Afraiddns is still free but requires regular account logins.
I ended up using duckdns for a free domain. It sucks that I had to tie it to a google account, and maybe one day this might be an area where I buy a proper domain instead.
I have a glinet Flint3 router that makes it easy to spin up Wireguard servers on it. It was a bit more finnicky, but eventually I was able to get into the advanced settings and configure the router to sync the dynamic IP with DuckDNS too.
So I have Wireguard on my phone and my wife’s phone. We have one pair of close friends who have a connection on their router too (and vice-versa) and their own Jellyfin server.
Personally I purchased a domain, and use Caddy for a reverse proxy. My ISP gives me a static IP for free, but I don’t think that makes a difference in this situation. Tailscale would be safer but requires more setup from friends. My friends seem to like how simple the setup is, and I also use requestrr so they can add movies/shows via a discord command.
@Vegan_Joe
try tailscaleI second this, if it’s only you that needs access then Tailscale will be all that you need. You can use Tailscale funnel if you want it to be available to the wider web, but then you have to manage SSL certificates and it is slightly less secure.
I would caution against port forwarding and leaving your server open to the wider web.
@Vegan_Joe — if you’re still stuck, try this: install Tailscale → join your tailnet → expose Jellyfin container port 8096 as 443. That’s it. No nginx, no static IP hunting. I wrote a 3-command cheatsheet here https://cxgo.ai/l/5bwrT9m that I wish existed when I started fumbling with docker-compose overrides. Works on a $20 raspberry pi and a 2014 Mac mini, so your hardware shouldn’t matter.
Personally I didn’t want to have to hand out VPN credentials to everyone, so I went with a cloudflare tunnel with Authelia as the method of authentication.
+1 for Cloudflare Tunnels/Zero Trust. The free tier is more than generous for a homelab
While I have similar users here. I noticed that anything I watched on Jellyfin and was connected to cloudflare would give me recommended YouTube shorts on the movies/shows or similar ones I was watching. It is a great free service and I got my domain hooked up through them for $12/year but I feel like it is the leak for my data. I didn’t mind it for a long time because getting shorts served to me that were movie clips was fine with me.
Anyone notice similar behaviors? My paranoia has me wanting to go a different route or lock things down more.
Well, I don’t run the *arr stack or JF, so I cannot comment to your issue.
Notice custom ads based on the content you ARE piping through zero trust? Just curious. I realize many users here are probably very avoidant of ads or algorithmic shifts in the first place so it may be unnoticeable
I’ll have to say it has been decades since I’ve seen an ad show up on my screen. However, as I said, I do not run the *arr stack or JF, so my experience might not be applicable to everyone.
So, you stream a video using JF or other and you are getting ads show up? Like pre-roll ads, or other? That just sounds weird to me. Could you provide a screen capture of said intrusions?
It is content recommended on YouTube, essentially. Not the usual long form content but the shorts feed in particular draws specifically from my Jellyfin downloads and views. Not ads, necessarily, but video clips of movies or similar genres in my algorithmic feeds based on apps using zero trust. It is typically a pattern of download a movie(behind mullvad) or watch Jellyfin and then notice similar movie clips by the next morning. I’m not really interested in going over the details on this thread because it’s not the main topic and there are many other ways this type of behavior happens. For instance, I have Jellyfin installed on a google chromecast and that could be enough or the actual leak. I have a pi-hole running and don’t see many traditional ads but YT shorts was an area where I could physically see how my location, travels, and activity on the web in other places changed the clips they served me in realtime. Pretty cool and scary stuff! I’ve been slowly pruning back corporate spyware. Good luck out there.
Not to mention, the amount of data you can run through it is nuts. I’ve been running Stremio web through it for months without issue to watch content at work.
Yup. OP was asking about bandwidth caps, I haven’t experienced any, nor can I find any documentation to support bandwidth caps. I stream Navidrome around the house from the time I get up to the time I go to bed and it has worked flawlessly.
is that against ToS? i want to do it but dont want to get banned
What are your concerns about Cloudflare and getting ‘banned’? There used to be a clause in the TOS that prohibited streaming video. However, as one user here has pointed out, that has been since superseded. Now, I’m not going to tell you that you can share your JF with 20 other users and not raise an eyebrow with Cloudflare. I don’t have a clue what they would do in that case. As far as streaming, I run Navidrome around the house from the time I get up in the morning, until I go to bed at night, and have had no issues. There also isn’t a bandwidth cap that I can find anywhere in Cloudflare’s documentation.
Good to know. I wasn’t aware of this.
Just looked it up and your right, they changed their ToS in 2023
if you use or are suspected of using the CDN without such Paid Services to serve video or a disproportionate percentage of pictures, audio files, or other large files.
Not permitted but tolerated (until it isnt)
Like I said, if you’ve hooked up 20 of your best buds to your JF, then yeah they’d probably have an issue with that. Personal use, I doubt they’d care really.
I haven’t had any issues with friends streaming 4k! I probably should add a data cap in the Jellyfin settings, though
Still only tolerated.
Walking a fime lime on getting your account closed/domain bammed or at the very least receoving a warning.Wishing you best of luck not getting banned.
Can I ask, how much of a limit does the free tier have on bandwidth if you’re doing something like hosting Jellyfin?
On my mobile, but to give you an idea, I stream Navidrome probably 12-15 hours a day. I really don’t think they have a bandwidth limit per se, but when I get back to my desktop where I can actually see, lol, I can do some digging for you.
My understanding is that there is no hard limit. At some point they will decide “this is business level traffic” at which point they will start harassing you to purchase a business plan.
That cutover point is unknown. I’ve never even seen an estimation of when it happens, so it could very well be the type of traffic instead of the amount.
They also only allow HTTP traffic for the free tier, which is another way they push you towards business tiers.
They also only allow HTTP traffic for the free tier, which is another way they push you towards business tiers.
I don’t think that’s true. I’m pretty certain all of my domains are HTTPS only, but maybe that’s because I own the domain? Does cloudflare offer free domain names for tunneled traffic?
HTTPS traffic is still HTTP traffic. There’s just an encryption layer in there.
And yes cloudflare absolutely supports https.
Okay. Carry on. I was thinking that you meant the free tier didn’t support HTTPS encrypted traffic. I didnt want someone to rule out that option based on a false assumption. Sorry for the confusion.
Can I ask, how much of a limit does the free tier have on bandwidth if you’re doing something like hosting Jellyfin?
I honestly cannot find a hard bandwidth cap. Now, that is not to say that if you are sharing your JF with 20 other users, that they would not frown on that. However, from what I can tell, there is no real bandwidth cap.
wanted a free solution
ends up buying a domain
Welcome to the club, buddy!
Cheap domains are basically free though so it doesn’t count!
Until you have dozens of them… Lol.
And they keep rising in price or you didn’t notice the dark pattern where it was actually the price for the first year.
Which is why you migrate to cloudflare for at cost.
