I have a Jellyfin server, NextCloud instance, etc that I share with friends and family. Currently, I serve them over the open-internet using Cloudflare tunnels. Obviously this has some security implications that I don’t love. Also recently one of my domains got flagged as malicious by google and now Chrome browsers won’t go to the site - annoying.

I use Tailscale already to access my server infra remotely, but honestly I don’t see this as a viable option for my non-technical friends and family. Plus, I need to support all kinds of devices like smart tvs. How do you fine folks deal with this issue?

    • rambos@lemm.ee
      link
      fedilink
      English
      arrow-up
      11
      arrow-down
      1
      ·
      1 year ago

      Friends and family are nice. In my experience they react like “wow amazing, how much you pay for that?” But they actually mean “wtf dude you never heard of netflix?” (:

    • nopersonalspace@lemmy.worldOP
      link
      fedilink
      English
      arrow-up
      4
      ·
      1 year ago

      I set up everything behind Authentik SSO so that, when they ask me to set them up with jellyfin to watch movies & tv, they suddenly have access to a whole suite of tools. That way, they can explore on their own and decide - which seems to work well. Not sure what kind of users you have, but mine are very quick to ring me up when something is not working!

      I’m quite terrible at keeping up with folks, and so I find these support calls to be a great way to keep in touch actually! But I could definitely see it getting annoying too.

    • finestnothing@lemmy.world
      link
      fedilink
      English
      arrow-up
      1
      ·
      1 year ago

      As much as I like fully self hosting, I ended up paying for Plex lifetime and have it running in docker. It was $120, but has already paid for itself twice over since I managed to convince my wife to drop hbo max, Netflix, and a couple others. She isn’t technical at all so she was hesitant, but she likes plex. If she can’t find what she wants to watch on our few streaming services (paid for by our cell provider, otherwise they’d be cancelled too), she can add it to the watchlist on Plex and radarr or sonarr will download it automatically and make it available on plex pretty quickly (or she’ll tell me to get it and let her know when it’s done).

      I could open my Plex server to more family or friends, but most of them either pirate stuff themselves or are fine with paying for streaming services for the ease of use.

  • Double_A
    link
    fedilink
    English
    arrow-up
    39
    arrow-down
    2
    ·
    1 year ago

    You don’t. Unless you want your hobby to turn into a 24/7 support job.

  • icedterminal@lemmy.world
    link
    fedilink
    English
    arrow-up
    32
    ·
    edit-2
    1 year ago

    Once you agree to letting friends and family access your hosted services, you become the tech support for any problems. Whether that be your fault, user error, etc. You should absolutely limit who you give access to. In my case, only three people can and that’s immediate family. No friends, no extended family. I don’t wanna deal with all that mess when I deal with it at work. Don’t over extend yourself by being nice.

    Using Cloudflare is against the ToS when used for services like Jellyfin. Your account can be limited, closed, or find yourself getting a several hundred dollar bill for data usage because you’ve breached the terms of service. Additionally, streaming content on free accounts incurs higher latency which I’ve confirmed myself Argo smart routing massively reduces. https://github.com/jellyfin/jellyfin/issues/9295 - Don’t abuse what’s free or you may lose it.

    Google shouldn’t be indexing your domains anyway. If it’s flagged your domain, it’s been indexed and scanned. Alternatively, it could indicate you have a weak point somewhere on your server and you’ve been breached. Google’s scan picked up whatever it was. Though I doubt this is the case and just a false positive. Double check your robots.txt files and disallow everything. Most index bots respect this. You can use a community sourced bot blocker. https://github.com/mitchellkrogza/nginx-ultimate-bad-bot-blocker

    I’ve been running my own self hosted services for almost a decade. Though I have a background in IT directly doing this kind of stuff daily at work. As long as you have a strong firewall, modern TLS, relevant security headers, automatic tools like fail2ban, and have a strong grasp on permissions, you should be fine. Before I moved everything to non-root docker, it was given its own service user and SELinux policy. Using direct DNS isn’t so much of a problem. You shouldn’t have any issues. Feel free to reach out if you have any questions.

    • nopersonalspace@lemmy.worldOP
      link
      fedilink
      English
      arrow-up
      2
      ·
      1 year ago

      I’m hoping it’s just a false positive. I have everything setup to not be indexed, and I just signed up for the google search console (to submit an appeal) and the console confirmed this. I was using cloudflare to block “bots and scrapers” and that seems to have blocked Google’s scraper/indexer. My best guess is they might have flagged it just for that, so I’ve turned it off for now.

      As for security, it’s an ever-evolving thing but I’m looking at ways to tighten it up. Since everything is behind Cloudflare, I also have them setting up SSL certs, and running firewalls. This lets me auto-ban “known malicious actors”, as well as any IP’s that aren’t geo-located to the US. Server-side, it’s not great though. I’m running unraid, which is… not known for it’s security. Not sure if there is much I can do about that though until I re-architect everything on a proper server.

        • nopersonalspace@lemmy.worldOP
          link
          fedilink
          English
          arrow-up
          1
          ·
          1 year ago

          Yeah, I used to run on proxmox and tried to roll-my-own stuff. I found it to be a lot of work in the areas I was less interested in, if that makes sense. I liked unraid for it’s ease of use, although I think in the end the gameplan is still to eventually move docker/applications off of the unraid box and have it be only for storage. Then I can have a regular linux box for all my applications & vms.

    • SheeEttin@lemmy.world
      link
      fedilink
      English
      arrow-up
      2
      arrow-down
      1
      ·
      1 year ago

      The Google warning page isn’t from a scan. I’ve seen it show up when visiting an entirely internal site in Chrome. It’s not exposed to the Internet, and the domain name doesn’t even exist in public DNS.

  • Rescuer6394@feddit.nl
    link
    fedilink
    English
    arrow-up
    11
    ·
    1 year ago

    i have a public ip and my own domain attached to that. i use subdomains for each service and a dashboard on the root domain.

    i don’t use authelia etc, and rely on the autentication page of each service. but i have fail2ban.

    i did help them set up the apps, but they took from there. the dashboard on the root domain helps them navigate all services without having to remember the full url.

  • lemmyvore@feddit.nl
    link
    fedilink
    English
    arrow-up
    8
    ·
    1 year ago

    I haven’t tried this yet I’ve only read about it. You can add an authenticator app + reverse proxy in front of HTTP services like Jellyfin. The combination Authelia + Traefik is often mentioned. When the person tries to open up the Jellyfin web app they see an Authelia screen asking for username + password, which when provided goes away and whitelists their public IP for a configurable time period. They don’t have to input the user+pass on the TV, they can visit the Jellyfin web app on their phone or laptop, then it will work for all devices behind that public IP. This would allow things like TV sets or Chromecast to work transparently.

    • nopersonalspace@lemmy.worldOP
      link
      fedilink
      English
      arrow-up
      1
      ·
      1 year ago

      I use Authentik for SSO, and I think it has some reverse-proxy features built into it. This would be a really interesting idea, I’ll look into it. Thanks!

      • lemmyvore@feddit.nl
        link
        fedilink
        English
        arrow-up
        2
        ·
        edit-2
        1 year ago

        I was just reading the Authentik docs the other day, it can do what I described above in a very similar way. It handles the authentication part and delegates the reverse proxy to an actual proxy (nginx, traefik, caddy, envoy etc.) They call it forward authentication.

        I’ll probably look more into Authentik as well because I’d also like to set up my own Identity Provider (for Tailscale and other things).

  • credics@kbin.social
    link
    fedilink
    arrow-up
    3
    ·
    1 year ago

    I have a domain which points to my router (over dynamic DNS). My parents’ Router connects to my home network via Wireguard using that. All my services have subdomains, for which I have set static DNS records that point to the local address (192.168…) of my server. This way, I only need to expose Wireguard to the public.

  • Decronym@lemmy.decronym.xyzB
    link
    fedilink
    English
    arrow-up
    3
    ·
    edit-2
    1 year ago

    Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:

    Fewer Letters More Letters
    DNS Domain Name Service/System
    HTTP Hypertext Transfer Protocol, the Web
    IP Internet Protocol
    Plex Brand of media server package
    SSH Secure Shell for remote terminal access
    SSL Secure Sockets Layer, for transparent encryption
    SSO Single Sign-On
    TLS Transport Layer Security, supersedes SSL
    nginx Popular HTTP server

    [Thread #99 for this sub, first seen 1st Sep 2023, 07:25] [FAQ] [Full list] [Contact] [Source code]

  • Strit@lemmy.linuxuserspace.show
    link
    fedilink
    English
    arrow-up
    2
    ·
    1 year ago

    I share my Home Assistant with family, Nextcloud and Jellyfin with family and friends and websites/blog with the entire world.

    I do it with a domain and a subdomain for each service. Each website/service has it’s own Let’s Encrypt SSL cert managed by Traefik. So all the family members and friends need is the URL and usernames and passwords. Like any other service. I don’t know what you did to become flagged as malicious by Google, but my services have run for years without such an issue. So maybe it’s just time to switch to a different domain name?

    • lemmyvore@feddit.nl
      link
      fedilink
      English
      arrow-up
      3
      ·
      1 year ago

      I don’t know what you did to become flagged as malicious by Google

      My dynamic public IP recently got flagged by Google and it wouldn’t allow logins to any Google accounts coming from my home, even with multiple correct authentication factors. We could connect though the data plan on our phones without a problem because they got (other) IPs from the mobile carrier, but not through the home ISP. We got security emails asking “is this you?” but confirming did nothing. It went away only when the ISP cycled to another of their public ranges.

      • Haui
        link
        fedilink
        English
        arrow-up
        1
        ·
        1 year ago

        Might be way off here but have you checked if you actually got hacked and they just didn’t destroy anything?

        • lemmyvore@feddit.nl
          link
          fedilink
          English
          arrow-up
          1
          ·
          1 year ago

          I would entertain the possibility if there was any sign, or if I knew how Google takes these decisions.

          • Haui
            link
            fedilink
            English
            arrow-up
            1
            ·
            1 year ago

            Honestly, I would just take this as an indicator of something fishy going on. Either google crawled your ip and found things it didn’t like or stuff came out of it to google. Either a scripted action (which looks malicious from the outside) or advertising emails. Your logs should at least tell you if there have been any suspicious logins on any of the exposed services.

            • lemmyvore@feddit.nl
              link
              fedilink
              English
              arrow-up
              1
              ·
              1 year ago

              That’s the thing, the only thing I have open to the Internet is a port forwarded SSH with non-root key authentication, into an up-to-date Debian stable. The logs show no attempts. The odds of someone breaking into public key OpenSSH and getting root, with daily security updates, are rather slim IMHO. The router is also an attack surface but it runs up to date OpenWRT.

              • Haui
                link
                fedilink
                English
                arrow-up
                1
                ·
                1 year ago

                In this case I‘m out of ideas. :) but thanks for elaborating. I appreciate it.

                • lemmyvore@feddit.nl
                  link
                  fedilink
                  English
                  arrow-up
                  1
                  ·
                  edit-2
                  1 year ago

                  No problem, you made a good point.

                  In any case, my main beef was that relying solely on IP is a pretty shitty way to deal with this on Google’s part. They make you jump through hoops and establish over half a dozen ways of proving who you are (user & password, secret question & answer, secondary emails, OTP codes, secondary auth codes, phone SMS, phone confirmation – which are behind phone unlock) and none of that matters when they don’t like your current IP? Then what are they for?

    • nopersonalspace@lemmy.worldOP
      link
      fedilink
      English
      arrow-up
      1
      ·
      1 year ago

      I use cloudflare’s firewall for some security rules, one of which was to block “known bots/scrapers”. This was blocking Google from accessing/scraping my site, and my theory is that they flagged it just because of that. I’ve turned it off for know, so we’ll see.

  • NeoNachtwaechter@lemmy.world
    link
    fedilink
    English
    arrow-up
    3
    arrow-down
    1
    ·
    1 year ago

    My home server is reachable via dynamic DNS. Nextcloud ist running from a VM that has no other ports open and I have done all the security things that the automatic checks have recommended.

    Nobody has dared so far to call me malicious.

  • CameronDev@programming.dev
    link
    fedilink
    English
    arrow-up
    3
    arrow-down
    1
    ·
    1 year ago

    How did you get your domain flagged as malicious? Are you on a noip or similar domain?

    I don’t have any answers for the jellyfish, but I host my seafile on the internet, so my family can access it, and haven’t had any issues yet 🤞

  • Sisko Urso@odin.lanofthedead.xyz
    link
    fedilink
    English
    arrow-up
    4
    arrow-down
    6
    ·
    1 year ago

    In regards to media server, may want to go with Plex over Jellyfin as you will find it much easier for those users who are not as technical and will offer support to far more devices which sounds like what you are looking for.

    • Domi@lemmy.secnd.me
      link
      fedilink
      English
      arrow-up
      6
      ·
      1 year ago

      I don’t think that holds true anymore nowadays.

      They added so much bloat to Plex that I constantly got asked where is X and do I need to pay for Y? When they started mixing online content with local libraries in all apps things got annoying because my older family members could not differentiate between them. Since there’s no server setting for this but only app settings I had to disable them for every device they use. Rinse and repeat every few months when they added another shitty service nobody asked for.

      This and that I couldn’t access my library without internet connection were the things that drove me to Jellyfin.

      • nopersonalspace@lemmy.worldOP
        link
        fedilink
        English
        arrow-up
        1
        ·
        1 year ago

        Yeah, I had plex forever and I spend way more time on the phone with people trying to explain how to use it’s god-awful UI than I ever did on regular tech-suport. Plus it made me cringe every time I had to use it. One day I tried Jellyfin and instantly knew I could never go back.

        I’ll admit, though, that Plex has better support for more platforms which is super nice.

    • Weslee@lemmy.world
      link
      fedilink
      English
      arrow-up
      4
      arrow-down
      1
      ·
      edit-2
      1 year ago

      I’ll second this - I found that alot of TVs don’t have native jellyfin apps, but they do have Plex.

      You can cast from your phone, but my mum found that to be annoying so I just went with Plex