You shouldn’t even have Jellyfin on a reverse proxy, because it shouldn’t be externally available. There are several known security vulnerabilities (all marked as “closed” due to inactivity on git) that the devs have said will likely never be patched. Because patching them requires breaking away from the Emby fork that the entire project is built on.

It should only be externally available via a private VPN. And that alone excludes a lot of “I want to share my library with friends/family” scenarios, because step 0 will be getting their devices connected to your VPN.

At the very least, set up some form of access control/username+PW directly on your reverse proxy as a secondary security measure. Because if you can reach the JF landing page, you can exploit those vulnerabilities without needing a valid JF login. So you should configure your reverse proxy to act as a gatekeeper, and ensure attackers can’t even reach JF at all without having a valid login to your reverse proxy. But this will break most JF apps (except for browsers) because they likely won’t have any way to give an initial user+pass to the reverse proxy before they hit the JF server.

I mean, in terms of raw capability, it’s actually one of the better “turn a dumb TV into a smart TV” devices on the market. It has good hardware transcoding support to take the burden off of your server. It also has very little in the way of fluff. It was one of the few boxes that wasn’t packed full of ads by default (though I’m not sure if this is still true).

But yeah, it means you’re locked into Apple’s ecosystem. Which is… Not always the best. Apple is notoriously difficult/annoying if your app gets tied up in approvals, so native apps can sometimes be trapped in limbo for a while. And that’s assuming they even allow the native app.

I guess you could build an HTPC with similar functionality and hardware support, but then you’ll be stuck using a Bluetooth keyboard to navigate things, plus all of the “oh let me wait for my computer to boot up before I can watch anything” pains that go along with it. There are solutions for a lot of the complaints, but a lot of them are fiddly or require lots of extra stuff just to achieve the same basic functionality of “remote has power button that turns on TV and streaming box, and navigates menus as if it’s a native app.”

I mean, that’s true regardless of how it is running. If the service is externally available, it will be probed for vulnerabilities. At least with a container, you can ward off what files it has access to, so an attacker can’t just ransomware your entire NAS with a single vulnerable service.

I mean, the Black Panthers started because people realized that peaceful unarmed protests would be violently busted, but peaceful heavily armed protests were politely watched from across the street. Blindfiring into crowds is a lot less appealing for cops when the entire crowd can return fire.

I remember seeing a pretty convincing “pro wrestling is just drag for people who are afraid of cross-dressers” argument, but I can’t remember the finer points.

Yeah, my complaints about Apple all stem from the fact that my industry has a standard program that only runs on Macs… And every Mac I’ve used has inevitably ended up taking 4x as long to do basically anything else when compared to Windows or Linux. The only reason I ever use a Mac is because my job requires it, and even then it is only begrudgingly; if there was a way to run the program on anything else, I would have done so a long time ago.

And yeah, I agree 100% about the “different first, better second” design choices. Lots of the most frustrating things about Macs are due to intentional design choices that Apple makes. Not because it is better for the user, but simply because it is different.

Yes. You only need to pay if you’re connecting via their relay or trying to use the remote hosting functionality. But since a VPN would land you inside of the network, you’d be fine. You’d probably need to dig into the plex settings to specify that the VPN subnet is LAN traffic. But after that, you should be good.

I mean, you just listed the most insecure way to host Jellyfin. Poking a hole in your firewall will technically work, but that doesn’t mean it’s the correct way to do things. A good setup would use a reverse proxy, and some sort of authentication wall like Authentik or Authelia.

All of that would only take about 15 minutes for someone who knows what they’re doing. But the vast majority of people setting up Jellyfin for the first time won’t know what they’re doing. And seeing the inevitable “lol just open your firewall” comments only serves to scare them away, because even the noobs have heads that’s the wrong way to do things.

Yeah, my “Public Transit” option on google maps is entirely greyed out. This is my daily commute to work:

It’s always entertaining to see the Europeans go “lol just ditch your car, it has to start somewhere” like it wouldn’t require me to move my entire family across town, (and pay 3x as much rent to live in the city…) Like I don’t even have the option of taking public transit, because there are no connecting lines between my home and my job. Literally none. The nearest bus stop is almost as far away as my job, and it’s in the opposite direction.

And to be clear, that 2+ hour walk would be on a highway with no sidewalk. I’d be dead on day 1. If I wanted to avoid the highway, the walk would be closer to 4.5 hours; The highway is the only direct path.