Please take this discussion to this post: https://lemmy.ml/post/28376589

Main content

Selfhosting is always a dilemma in terms of security for a lot of reasons. Nevertheless, I have one simple goal: selfhost a Jellyfin instance in the most secure way possible. I don’t plan to access it anywhere but home.

TL;DR

I want the highest degree of security possible, but my hard limits are:

  • No custom DNS
  • Always-on VPN
  • No self-signed certificates (unless there is no risk of MITM)
  • No external server

Full explanation

I want to be able to access it from multiple devices, so it can’t be a local-only instance.

I have a Raspberry Pi 5 that I want to host it on. That means I will not be hosting it on an external server, and I will only be able to run something light like securecore rather than something heavy like Qubes OS. Eventually I would like to use GrapheneOS to host it, once Android’s virtual machine management app becomes more stable.

It’s still crazy to me that 2TB microSDXC cards are a real thing.

I would like to avoid subscription costs such as the cost of buying a domain or the cost of paying for a VPN, however I prioritize security over cost. It is truly annoying that Jellyfin clients seldom support self-signed certificates, meaning the only way to get proper E2EE is by buying a domain and using a certificate authority. I wouldn’t want to use a self-signed certificate anyways, due to the risk of MITM attacks. I am a penetration tester, so I have tested attacks by injecting malicious certificates before. It is possible to add self-signed certificates as trusted certificates for each system, but I haven’t been able to get that to work since it seems clients don’t trust them anyways.

Buying a domain also runs many privacy risks, since it’s difficult to buy domains without handing over personal information. I do not want to change my DNS, since that risks browser fingerprinting if it differs from the VPN provider. I always use a VPN (currently ProtonVPN) for my devices.

If I pay for ProtonVPN (or other providers) it is possible to allow LAN connections, which would help significantly, but the issue of self-signed certificates still lingers.

With that said, it seems my options are very limited.

  • The 8232 Project@lemmy.mlOPEnglish
    2·
    5 days ago

    but I’d suggest reconsidering the Pi

    It’s what I have on hand at the moment. I don’t have proper server hardware yet.

    and a microSD to host Jellyfin.

    Beyond that, SD cards are terrible for this kind of task and you’d be much better served with an SSD as your boot/data drive for robustness. I can’t even count the number of failed SD cards I’ve had over the years.

    I will keep this in mind, thank you!

    Neither one of these are a good fit unless you plan on sticking to very specific audio and video codecs to avoid all transcoding and your upload speeds are capable of serving the full bitrate of your files.

    I haven’t tried playing videos from my Raspberry Pi, but I’ve been able to run extremely modern video codecs on some pretty old hardware without any issues. Since I’ve never had issues with video codecs, I’m not experienced in what hardware can and can’t handle it.

    • beerclue@lemmy.worldEnglish
      21·
      5 days ago

      A micro sized PC with an i5 and 8gb or ram can cost under 100€, and it’s way more powerful compared to a pi. Power efficient too. That’s what I used for a long time for my jellyfin server.

      • The 8232 Project@lemmy.mlOPEnglish
        2·
        5 days ago

        Thank you! I’d like to avoid extra costs, since I already have the Pi on hand, but when I have the money I will switch to a proper server.

        • beerclue@lemmy.worldEnglish
          11·
          4 days ago

          I don’t think so, but don’t quote me on that. My machines come with a 65w charger.

          • AtariDump@lemmy.worldEnglish
            1·
            4 days ago

            It cannot.

            While used equipment is more powerful then a Pi, it doesn’t always fit everyone’s use case and I hate it when people have a “one size fits all” solution.