[heavyset_go]

Don't expose it to the internet unless you know what you're doing, or put it on a VPS you don't care about.

Ideally keep it behind a VPN and give your family members access to it that way, and let local devices on your LAN connect to it without a VPN.

[ssl-3]

Those are fine ideas.

But I'm not all about getting something like Tailscale to work with my elderly mother's Roku device, nor teaching her how to use it.

[lamasery]

Get your elderly mother an Apple TV and infuse, then connect with Tailscale. It’s pretty friggin’ smooth in daily operation. Apple TV’s UI is no easier to get lost in than Roku, and actually has fewer pitfalls if you toggle one setting (the one that makes one home tap open the Apple TV app, and a second press while in that app actually go home, by default; switch that to always go home on any press of that button no matter what)

I dunno if Tailscale works on Roku but otherwise that would indeed be entirely viable too, last I saw Jellyfin’s app on there is really good. Likely need a server powerful enough to transcode, though, lots of (all?) Roku devices don’t have hardware decoding for newer codecs like h.265. That’s one big benefit of an Apple TV, it can hardware decode damn near everything.

[ssl-3]

Perhaps.

Y'all (collectively) have some good ideas.

But she likes the Roku. She's even got silicone skins for the remotes (plural; spares!), and two of them are tethered near the chairs that her and dad tend to sit in.

Also: The Roku stuff already exists, and is paid for, and it works with Plex (without a VPN, because my local Plex container didn't come with the caveat to avoid exposing it to the world).

Buying them one or more Apple TV devices to use instead seems expensive and likely to fail somehow.

Switching them to (cheap? linux?) PCs also sounds expensive and bad, particularly with my dad. He's certainly had more years to learn how to use a computer than I have, but he's spent most of the recent decades deliberately avoiding them. He hates them, and he doesn't want to learn them. He'd fall apart and give up on television entirely if I gave him a PC with a slick Logitech K400 to run it with. (He can drive a Roku with Youtube TV and Plex like a pro, but that's mostly only a D-pad and a back button.)

---

But since you and others have mentioned it: Transcoding. That's really not a big problem for many vaguely-recent PCs. With Plex, at least: The quite old i7-6700k desktop box I use for this transcodes to h.264 like a beast using its paltry iGPU, and does h.265 just fine with an old nVidia RTX 2080 if I elect to use that instead. Either way works well and never breaks a sweat.

It may have been a powerful machine a decade ago, but a used computer with a 6700k (or so) to serve media with is cheap these days. (And a brand-new power-sipping N150 box does transcoding waaaay better, even in credit-card form factor.)

[organsnyder]

A couple of other options:

If their router supports it, configure the VPN there so it's available for the entire network.

Set up a Raspberry Pi (or similar) on their network that is configured with the VPN and runs a reverse proxy to expose the Jellyfin instance.

But yeah, either of those is going to increase your support burden.

[dmos62]

Sad to hear about people getting stuck in weak ecosystems.

By the way, I switched from Jellyfin to plain SMB + Nova Player (Android), which has basically the same interface, but no user profiles, and works over SMB, obviously. No transcoding, best format support, and best performance for large files I've found yet for my TCL Android TV.

[ssl-3]

I mean, for my TV at home where everything is connected with a gigabit LAN, I usually use Kodi on a Pi4, over SMB, with a Logitech KT400 to drive it from wherever I feel like sitting.

It's silent, reasonably self-contained, and is appliance-like to get going (just dump OpenELEC onto an SD card, plug everything in, and then simply begin using it).

Plus, there's two HDMI outputs: One that connects directly to the the dumb TV and sends only video, while the other sends only lossless PCM audio to the once-rather-high-end AV receiver (that gets choked up on more-modern HDMI bitrates).

And that's great for me at my house, with my pile of gear, and with my technical proclivities.

But I'm not my mom, and this isn't my mom's house. :)

[whywhywhywhy]

I use Jellyfin and when it works it’s great but a few small things make it totally unusable for a non-technical family member.

One thing is when it can’t see the server it doesn’t just say it can’t see it, it acts like the issue is you’re not logged in and then when you log in (having to type your password manually each time, on a TV) it then fails.

This is only really diagnosable if you can access both the client and server and is a complete failure and very tedious experience if you only have client access.

Feels like I experience this at least once a month so couldn’t ever set this up for family members remotely.

[ray_v]

I set my dad up with a Linux box as a daily driver for him - he keeps the desktop on , and the roku jellyfin now has a clean proxy into jellyfin over the tailscale network. Giving him a desktop I can remote into was a great decision that paid dividends for him :)

[asixicle]

You can point Tailscale toward a $5 exit-node VPS and Caddy/nginx through a cheapo-but-memorable-domain to get a Jellyfin Dashboard up in a browser. I assume running the domain and port through the Jellyfin Roku app would work fine (can't be sure as I've never used a Roku).

Just mind your ACLs

[voxic11]

I put mine behind caddy on a long unguessable path prefix. So that acts as a sort of password that you need to know before you can access it at all. So far it's seemed to work great. The advantage to using a path prefix vs like caddy basic auth is that its compatible with all the normal jellyfin clients.

[heavyset_go]

You can also use HTTP auth with your reverse proxy and it works with all Jellyfin clients

[RajT88]

TLS is a must-have. They don't bother doing any kind of password hashing on login. It's sent in cleartext.

[teraflop]

That's no different from how just about any other webapp works.

"Bothering" with client-side password hashing, in the absence of TLS, is security theater. It provides only the most trivial protection against eavesdroppers.

If someone can steal an unhashed password, then they can also steal whatever hash you send instead. If you try to fix this with some kind of ad-hoc challenge-response protocol, then the attacker can just steal your session cookie after login.

There shouldn't even be a question of using insecure HTTP for anything that requires authentication.

[RajT88]

> "Bothering" with client-side password hashing, in the absence of TLS, is security theater.

Filtering out unsophisticated attackers I would not classify as "theater".

Read this, and let me know if the implications of port forwarding your server (or putting it on IP6) is readily apparent:

https://jellyfin.org/docs/general/post-install/networking/#s...

A lot of these users are not very sophisticated themselves. The least sophisticated attackers are likely to be the most numerous.

This is bad. People who say it's not bad (or worse, suggesting anyone dumb enough to publicly expose their server without TLS) are engaging in security snobbery.

[heavyset_go]

Yes, TLS should be considered a given. Set things up right and you can use TLS locally, too, with Let's Encrypt, which is a prereq to stream some things to streaming sticks using Jellyfin's raw HTTP streaming without a Jellyfin client.