Selfhosted

I access it through a reverse proxy (nginx). I guess the only weak point is if someone finds out the domain for it and starts spamming the login screen. But I've restricted access to the domain for most of the world anyway. Wireguard would probably be more secure but its not always possible if like on vacation and want to use it on the TV there..

I host it publicly accessible behind a proper firewall and reverse proxy setup.

If you are only ever using Jellyfin from your own, wireguard configured phone, then that's great; but there's nothing wrong with hosting Jellyfin publicly.

I think one of these days I need to make a "myth-busting" post about this topic.

I use a VPS and a wiregusrd tunnel.

https://codeberg.org/skjalli/jellyfin-vps-setup

Jellyfin isn't secure and is full of holes.

That said, here's how to host it anyway.

1. Wireguard tunnel, be it tailscale, netbird, innernet, whatever
2. A vps with a proxy on it, I like Caddy
3. A PC at home with Jellyfin running on a port, sure, 8096

If you aren't using Tailscale, make your VPS your main hub for whatever you choose, pihole, wg-easy, etc. Connect the proxy to Jellyfin through your chosen tunnel, with ssl, Caddy makes it easy.

Since Jellyfin isn't exactly secure, secure it. Give it its own user and make sure your media isn't writable by the user. Inconvenient for deleting movies in the app, but better for security.

more...

Use fail2ban to stop intruders after failed login attempts, you can force fail2ban to listen in on jellyfin's host for failures and block ips automatically.

More!

Use Anubis and yes, I can confirm Anubis doesn't intrude Jellyfin connectivity and just works, connect it to fail2ban and you can cook your own ddos protection.

MORE!

SELinux. Lock Jellyfin down. Lock the system down. It's work but it's worth it.

I SAID MORE!

There's a GeoIP blocking plugin for Caddy that you can use to limit Jellyfin's access to your city, state, hemisphere, etc. You can also look into whitelisting in Caddy if everyone's IP is static. If not, ddns-server and a script to update Caddy every round? It can get deep.

Again, don't do any of this and just use Jellyfin over wireguard like everyone else does(they don't).

Wireguard VPN to my fritzbox lets me access my jellyfin.

Full guide to setting up Jellyfin with Reverse Proxy using Caddy and DuckDNS

I followed this video and modified some things like ports

I use a wire guard tunnel into my Fritz box and from there I just log in because I'm in my local network.

If it’s just so you personally can access it away from home, use tailscale. Less risky than running a publicly exposed server.

Wireguard.

VPN or Tailscale

Nginx in front of it, open ports for https (and ssh), nothing more. Let's encrypt certificate and you're good to go.

Tailscale

This is my setup.

Read more, here.

I don't host my media outside my local network but, if I did, I would use my go to method of SWAG with Authentik. This is what I have done for my other self-hosted items.

Is putting it behind an Oauth2 proxy and running the server in a rootless container enough?

I just install tailscale at family houses. The limit is 100 machines.