Hi all,

I am running proxmox on a mini PC with a handful of services in my stack. I also run NPM in an LXC to reach my services through my domain name (service.domain.tld).

For my Arr related stuff, I use Usenet, and everything runs through a VPN.

I have three services which are public. Jellyfin, Seer and BookOrbit (for syncing Kobos).

Currently I have no security besides the built in login managers from the services, but I am considering setting up Authentik. I know I’m asking for trouble with my current set up.

I have elderly and extremely tech averse family members who live in two countries other than me, so tech support can be a challenge.

A lot of people suggest running a VPN, but it would be difficult for my family and I don’t know how to make it work syncing our Kobos with BookOrbit.

I’ve also seen some posts about tunneling to a VPS somewhere and users can connect to the VPS without a VPN.

I feel this question has been asked several times, and I tried searching here and on the internet in general, but my knowledge is not good enough to use the right terms and to get something that is idiot proof.

Any suggestions on best practices or links to guides you recommend would be much appreciated. Also, what EU based affordable VPS would you recommend?

  • phobiac@lemmy.worldEnglish
    3·
    9 hours ago

    For whatever it is worth to you I’ve hardened my jellyfin docker compose this way. I’m obscuring some things in this that are local to my network.

    The container is read only. It mounts the media read only. It should be fairly isolated from getting privileges it shouldn’t have. The only things lost in this setup are the ability to delete media from a jellyfin client (something I never do) and the ability to manipulate files directly stored with the media. I use bazarr for subtitles so don’t need jellyfin to download them and I don’t keep trickplay or any other jellyfin metadata related files alongside the media. I feel pretty confident with this that even if the jellyfin codebase had a serious 0 day that the worst I’d lose is metadata and server setup, and important config files I have backing up to another machine.

    I’m sure there’s things I’ve overlooked with this setup so I’m very open to being told there’s a better way to do something.

    services:
  jellyfin:
    image: jellyfin/jellyfin:latest
    container_name: jellyfin
    restart: unless-stopped
    mac_address: OBSCURED # see macvlan note below
    hostname: jellyfin
    user: ${PUID}:${PGID}
    group_add:
      - "992" # my render group id
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    read_only: true
    tmpfs:
      - /tmp:exec,nosuid,nodev # exec some plugins can write to /tmp, no-nosuid,nodev for security
    networks:
      macvlan:
        ipv4_address: OBSCURED
    healthcheck:
      test: [ "CMD", "curl", "-fsS", "http://127.0.0.1:8096/health" ]
      interval: 1m
      timeout: 10s
      retries: 3
      start_period: 30s
    environment:
      - TZ=${TZ}
      - JELLYFIN_PublishedServerUrl=OBSCURED
      - JELLYFIN_DATA_DIR=/config/data # consolidates these dirs under /config, migrated from linuxserver.io setup
      - JELLYFIN_CONFIG_DIR=/config
      - JELLYFIN_LOG_DIR=/config/log
      - JELLYFIN_CACHE_DIR=/config/cache
      - HOME=/config
    volumes:
      - ./jellyfin:/config
      - ${MEDIA}:/media:ro
    devices:
      - /dev/dri/renderD128:/dev/dri/renderD128 # isolate to just the renderD128 device
    device_cgroup_rules:
      - 'c 226:128 rw' # further limits access for the renderD128 device

networks: # I went with macvlan to preserve mdns for local discovery, otherwise you need to use host level networking
  macvlan:
    driver: macvlan
    driver_opts:
      parent: OBSCURED # Replace with host network interface name (find via: ip route | grep default)
    ipam:
      config:
        - subnet: OBSCURED/24 # Your local LAN network CIDR
          gateway: OBSCURED # Your local router IP address