I just realized JMP cannot handle HTTP Basic Auth. What are your experiences with netsec overlays? LDAP? ...and SSO?

[Siress]

I'm playing around with a kubernetes cluster in TrueNAS SCALE using the TrueCharts line of apps. I have a dynamic IP like most homes, so I have a DDNS with Cloudflare. On paper, I really like the architecture of having Cloudflares free proxy service forwarding my subdomains to Traefik (reverse proxy), then forwarding authentication to Authentik (SSO front-end) that can then handle the various authentication providers (of which it seems that Jellyfin Server can support LDAP only).

Please correct me if there's something wrong with that architecture. So far, I've only implemented the reverse proxy and am still handling users via the Jellyfin GUI. I'd really like to get Authentik up and running, but not if it's going to break access for devices using the typical jellyfin clients like JMP.

[iwalton3]

I can confirm that JMP is unable to handle any kind of supplementary auth. It's annoying for me too but since other apps don't support it either it seems like it is better to spend time hardening Jellyfin than adding extra auth mechanisms.

(As far as hardening Jellyfin is concerned there are definitely some things that need to be done, for instance not allowing assets to be served without auth.)

[Siress]

That is a bummer.

I'd like to continue using Jellyfin to share our family videos. Ignoring backups, what do you recommend we do to keep bad actors from having the ability to modify or delete any of the content exposed via Jellyfin? Can we configure the Jellyfin Admin to remove the ability to modify and/or delete library files without compromising it?

The alternative is that I only use the exposed Jellyfin instance for media that I can tolerate losing or being made public. I can still have the family media on the local network with substantially less risk.

BTW: Thank you so much for your contributions to Jellyfin! It has been the nucleating force for me to stop being interested in home servers and actually building out a home lab beyond a simple NAS.

[iwalton3]

It's still probably fine to expose with the standard Jellyfin auth for most purposes. If you're worried, I personally use an IP address firewall rule and manually add allowed hosts.