Please can someone show off how smart and sexy they are by answering these questions. I don’t mind if you just link me to a video or guide explaining it (like I’m 5?) instead of typing it out - but please don’t just send me stuff that says something like “To forward to ports correctly, simply forward the correct ports - but be sure to reverse-p the goeanity-2.0 exposed server flange via qPack*7_bingb (IMPORTANT put 1=2 in /conf!!!)” - which is what all the help documents read like to me right now.

Here’s what I think I know, but I have probably got wrong, and would be delighted if you could not only tell me how wrong I am but what is the right answer instead:

-> I have a raspberry pi 4 running raspbian/debian bookworm, all software up to date.

-> I have installed docker and docker compose. Docker lets you run apps/programs in separate little cages so if they crash or do something insecure they don’t crash or expose the whole computer (the Raspberry Pi), the operating system (Raspbian), or the other apps running in other containers. Docker compose allows you to fine-tune the settings of these apps from outside the container by changing a text file. Each docker container, controlled by a compose yml has a port, e.g. Jellyfin’s is :8096

-> I can set up and configure radarr sonarr qbittorrent to download movies, for this I need a VPN. I paid for and installed mullvad (app) but it crashes a lot (for over a minute every 20 seconds), so it looks like I need to configure something like gluetun to do it instead. For this reason I want to stick with mullvad as I paid for it, gluetun is really confusing.

-> However, downloading is only half the battle - assuming I can get a VPN to work without crashing every 20 seconds so it takes less than 5 hours to download a single movie in 1080p(!!!) - I can only watch stuff by plugging an HDMI cable into my raspberrypi and a monitor and using a mouse and keyboard to navigate to the UI and click “play”

-> If I want to watch them on my TV I need to connect something to my TV that talks to the raspberry pi, so I have an NVIDIA shield with Jellyfin installed on it - but in order for the NVIDIA-Jellyfin to connect to the RaspberryPi-Jellyfin it needs to go through the internet (if this is not the case, how does one point the NVIDIA-Jellyfin at the Raspberry Pi jellyfin?)

-> Because it’s going through the internet I need to hide my activities from prying eyes, and because it’s on the internet it will have a web address (I bought the cheapest domain for a few bucks on namecheap), so a proxy and reverse proxy are neccessary to hide my activity on my end (proxy) and the activity on the internet (reverse proxy) from said prying eyes while allowing me to watch my stuff in peace.

-> I can set up my domain to point to Jellyfin, this means I configure mysubdomain.mydomain.com to point to Cloudflare on the internet. Then I set up Cloudflare to point to NGINX on my raspberry pi. But I really don’t know what this entails or how to do it. I changed my nameservers to Cloudflare’s on namecheap and that’s where I stopped because I didn’t understand any further.

-> So, in practical terms, I’m on my sofa and I want to watch a movie in my Jellyfin on my raspberry pi, I open the NIVIDA sheild, I open the jellyfin app and I tell the jellyfin app to go to mysubdomain.mydomain.com

-> I think I’m correct in saying that mysubdomain.mydomain.com is actually an IP address and a public port, so something like 123.456.7.8:443, then Cloudflare - which is the reverse proxy - gets involved (somehow? how?) to say “ah, 123.456.7.8:443, you obviously want to go to funkless.raspberry.pi:NGINX (or rather something like 987.654.3.2:443)” and then NGINX - which is the proxy-proxy, not a reverse-proxy - goes (somehow? how?) “ah, 987.654.3.2:443, you obviously want to go to 987.654.3.2:8096 which is jellyfin”)

-> At some point in that last step SSL certificate(s?) need to be issued and used on Cloudflare and/or NGINX - but I don’t know how or why - and/or a public and private key

Here’s where the questions start:

  • First of all, is that all correct or have I misunderstood something?
  • How does mysubdomain.mydomain.com know it’s me and not some random or bot?
  • How do I tell Cloudflare to switch from web:443 to local:443 (assuming I’ve understood this correctly)
  • Is this step “port forwarding” or “opening ports” or “exposing ports” or either or both? (I don’t understand these terms)
  • If my browser when accessing mysubdomain.mydomain.com is always going to port 80/443, does it need to be told it’s going to talk to cloudflare - if so how? - and does cloudflare need to be told it’s going to talk to NGINX on my local machine - if so how?
  • How do I tell NGINX to switch from local:443 to local:8096 (assuming I’ve understood this correctly)
  • Is there a difference between an SSL cert and a public and private key - are they three things, two things or one thing?
  • Doesn’t a VPN add an extra step of fuckery to this and how do I tell the VPN to allow all this traffic switching without blocking it and without showing the world what I’m doing?
  • Gluetun just looks like a text document to me (compose.yml) - how do I know it’s actually protecting me?
  • From https://nginxproxymanager.com/ : "Add port forwarding for port 80 and 443 to the server hosting this project. I assume this means to tell NGINX that traffic is coming in on port 80 and 443 and it should take that traffic and send it to 8096 (Jellyfin) and 5000 (ombi) - but how?
  • Also from that site: “Configure your domain name details to point to your home, either with a static ip or a service like DuckDNS or Amazon Route53” - I assume this is what Cloudflare is for instead of Duck or Amazon? I also assume it means "tell Cloudflare to take traffic on port 80 and 443 and send it to NGINX’s 80 and 443 as per the previous bullet) - but how?

If your reaction is “Asking how how to set up port forwarding from Cloudflare to NGINX is a cowardly question - just figure it out!” Please could you at least link me to something that will help me figure it out if all those words just look like gibberish to me?

Thank you so much for your help and time in advance.

  • CalicoJack@lemmy.dbzer0.comEnglish
    13·
    11 months ago

    If you’re only trying to use Jellyfin at home, you don’t need any reverse proxy or domain. All you need is for both devices to be on the same network, and for the Raspberry Pi to have a fixed internal IP address (through your router settings).

    On the Shield, you just give the Jellyfin app that IP address and port number (10.0.0.X:8096) to connect and you’re good to go.

      • CalicoJack@lemmy.dbzer0.comEnglish
        12·
        11 months ago

        Exactly. Doesn’t matter if they’re wired or wifi, or where they are, as long as they’re on the same network you’re fine.

        • funkless_eck@sh.itjust.worksOPEnglish
          23·
          11 months ago

          ok. I would still like to learn this stuff, so hopefully someone can come in and answer some of the questions - but it seems like, then, the challenge is just gluetun for now.

  • False@lemmy.worldEnglish
    5·
    11 months ago

    A lot of this is being complicated for you by not understanding networking fundamentals. I’d suggest looking into a Network+ certification which will cover all of these basics like DNS. You don’t have to actually get the cert, just going through the motions on learning the material should help a lot.

    You seem to be close on grokking the whole picture and just need some of the basics that are hard to pick up from just doing things at home. A lot of work has been done to try abstract that away from consumers in order to make things easier which is making it harder for you.

  • Fuzzypyro@lemmy.worldEnglish
    2·
    11 months ago

    Tons of good responses here. I’m surprised that nobody has brought up Tailscale though. It’s def the easiest vpn solution I have found. It’s got some great documentation and how to projects to get a home lab running and it’s got its own domain system baked in most of it being zero configuration. You can access mullvad vpn exit nodes straight from it, and set up those domains with ssl super easy e.g.

    sudo tailscale serve —https=443 localhost:8096

    That single command would allow any other devices connected to your Tailscale account to reach your Jellyfin using the domain “{serverhostname}.[tail-scale].ts.net” complete with a private reverse proxy and ssl cert.

    There are a few things to click around in tailscale on but it’s a extremely easy to use free application that has made my self hosted life significantly easier due to my system living behind multiple firewalls that I sadly have no control over.

  • Delphiantares@lemmy.worldEnglish
    1·
    11 months ago

    If you get a reverse proxy setup all you need is port 80 and 443 and configure it it’ll expose the services that you want to be exposed through the subdomain Personally I’ve got Traefik service sitting on my media server and anything I want to expose goes through it .it has the details for the connection to cloudflare and so long as I direct it properly both on the container side and Traefik it’ll run as expected. The idea is if you go to say jellyfin.example.com cloudflare will direct that at at your reverse proxy(nginx in this case) which then redirects to the right machine/container because you entered from “jellyfin” .

    The VPN gluten it is another container that will have the login details to your provider .

    I’m still working my way through the self hosted rabbit hole myself, however I used a combination of Google and this sitehttps://www.smarthomebeginner.com/traefik-docker-compose-guide-2022/ The entire site not just the specific article linked . As well as https://trash-guides.info/