OK so i am setting up a home server to use jellyfin and nextcloud. i want to make it accessable from the internet using reverse proxy. should i waste the time trying to get it to work in proxmox or would fedora server and podman be a better solution?
It depends. What are your goals? Will you be the only one accessing it? Do you want to share it with friends and family? Are they willing to install a VPN client? What is your storage situation? Do you have more experience with deb or rpm-based distros? Do you want/need a GUI? Did you plan to use LXC or VMs in Proxmox?
so to answer that question planning on using a reverse proxy because it will include friends and family and they are not used to VPN’s i have experience with both i would be using LXC containers as it is an older i7 with only 32GB ram currently a single 22tb hd for storage plus my nvme OS drive. i use arch myself but setting up arch as a decent server is a pain in the ass I don’t want to get into.
So if VMs are out of question, Nextcloud has an official docker image. I would go the official/supported route. I don’t remember NC beeing a pleasent piece of software to install and maintain by hand.
IIRC docker containers are not well integrated into proxmox → better use fedora.
Jellyfin on podman is easy.
My working config for jellyfin
[Unit]
Description=jellyfin
[Container]
Image=docker.io/jellyfin/jellyfin:latest
AutoUpdate=registry
PublishPort=4040:8096
UserNS=keep-id
GroupAdd=keep-groups
#SecurityLabelDisable=true
AddDevice=/dev/dri
# Cap /tmp size to 4GB, to avoid OOM crash
Tmpfs=/tmp:rw,size=4G,mode=1777
Volume=%h/jellyfin/config:/config:Z
Volume=%h/jellyfin/cache:/cache:Z
Volume=/storage_spaces/movies:/media:ro
[Service]
# Inform systemd of additional exit status
SuccessExitStatus=0 143
[Install]
# Start by default on boot
WantedBy=default.target
Proxmox has the benefit of backups being easy, there is also:
Which is nice for absolute beginners but does not allow much customisation
Edit: also hosting nextcloud open to the internet is kind of a “you need to know what you’re doing” situation in my opinion. They had some serious CVEs in the past.
Simple:
If you’re lazy, just setup a Linux desktop with everything and install Tailscale.
Spend all ur time learning and setting up isolation subnets in TS, or use AI.
Longevity/upgradability:
Set up proxmox, and lxc - with Tailscale and the same level of access, but as a bridge.
Give everyone accounts on Tailscale.
Don’t bother with VPNs.
oh i’m aware of the CVE’s but the group of people i colab with are currently using microsoft 365 and i can’t stand that would rather self host something we can all use and with only one machine to use right now need jellyfin on it for the family and a few close friends. if hardware were actualy affordable i would just add another machine for nextcloud but it is what it is
I would put tailscale on friends and familys devices before ever thinking of exposing NC and Jellyfin to the internet. But hey it is your call.
I’m using tailscale and just share out my media server to other tailscale accounts. Works really well.
Another option would be a cloudflare tunnel with say email auth. So only people with select email adresses can receive access codes to let them through to your server. You can customize the time interval at which reauthentication is required to not overburden the users.
Look at Cloudflares Zero Trust → Access settings.
My recommendetion would be:
- use official containers published by NC and Jellyfin
- run them on fedora/podman
- restrict access with e.g. Cloudflare Zero Trust/Access email auth
if i could get my parents to use talescale I would, you know some older people just getting them to use jellyfin instead of spending outrageous amounts on streaming services on a fixed income is hard. so my plan is to use wireguard to at least minimize the risk.
They should already be used to email 2FA, the Cloudflare setup would be identical to that.
Open website → be prompted for 6-digit code sent by email → get access to Jellyfin/Nextcloud.
1 Like
Hmm I don’t get that, they won’t use tailscale but will use wireguard? I would also go the Cloudflares Zero Trust way @Zszywany suggested.
i should have been more clear the people i collaborate with will use it with nextcloud so i plan to use wireguard to mitigate nextcloud CVE’s using a hybrid security model while leaving jellyfin alone since my parents won’t install stuff live talescale or anything else. i proboble could use talescale in the same hybrid modle but i know how to do it with wireguard without needing research.
What I do for my parents is maintain a persistent Wireguard tunnel from their router to mine. A firewall rule routes traffic to my Jellyfin server’s private IP address over the VPN tunnel. Works great from their Roku.
I have a small Unraid NAS server I run Jellyfin and a variety of other small things. I use Tailscale for VPN access as needed and Cloudflare tunnels for non vpn access to things like Jellyfin. You do need a domain for that, but it is like $10 a year.