• ohshit604@sh.itjust.works
    link
    fedilink
    English
    arrow-up
    1
    arrow-down
    2
    ·
    4 hours ago

    Do not rely on an OIDC/LDAP provider with Jellyfin, you cannot run these in front of your proxy otherwise Jellyfin applications will not be able to communicate with the server.

    Blacklist all IP address and whitelist the known few, no need for Fail2Ban or a WAF.

    • AllHailTheSheep@sh.itjust.works
      link
      fedilink
      English
      arrow-up
      3
      arrow-down
      1
      ·
      3 hours ago

      you totally can use ldap or oidc it just requires more setup. you just ensure jellyfin and your source of truth talk on their own subnet, docker can manage it all for you. ldap can be setup to be ldaps with ssl and never even leave the docker subnet anyways.

      and yes I suppose you could rely on whitelists, but you’d have to manually add to the whitelist for every user, and god forbid if someone is traveling.