SOLVED: Access via local domain works in browser but not app

[mari]

So I have jellyfin running on my TrueNAS's Docker. Works great, via IP:Port. I set up local domains such as jellyfin.local, put them in my local DNS server, and pointing them to a local instance of caddy which is reverse proxying to the internal jellyfin IP:Port, and adding it's own self-signed cert.

It works great in the browser (after accepting the self-signed cert), but the jellyfin media player app, both on the same computer as well as on my smart TV, cannot connect to the server via https://jellyfin.local. I also confirmed via my pihole log that the jellyfin app is sending it's requests to the pihole, so it shouldn't be a DNS issue.

I thought perhaps the app doesn't accept the self-signed certs, so I got caddy to serve jellyfin.local via http, but still the app will not recognize the server on https://jellyfin.local either (which again works in my browser, after a few tries of stopping the browser from auto-redirecting to https).

I also tried adding my caddy local IP to "known proxies" in jellyfin networking settings, as well as adding all=http://jellyfin.local or all=https://jellyfin.local to the "published server URIs". No success.

I have done some debugging and narrowed down to the following:
- The app is hitting the correct DNS, and the DNS is returning the IP of the caddy proxy.
- The caddy logs do NOT show any hits when trying via the app. The logs do show when I successfully connect via the browser.

Any ideas what I need to do to get the jellyfin app to recognize my local domain?

[TheDreadPirate]

If you are using https with self-signed certs, a lot of our apps will fail to connect. Unless you add your cert to the OS's trust store. If these will be local only connections, why bother with https? Or caddy for that matter?

Do you intend to setup remote access via Caddy at a later time?

[mari]

If you are using https with self-signed certs, a lot of our apps will fail to connect.  Unless you add your cert to the OS's trust store.  If these will be local only connections, why bother with https?  Or caddy for that matter?

Do you intend to setup remote access via Caddy at a later time?

Caddy is simply in order to make more user friendly urls for all my services. Both for me when I'm setting things up and trying to remember the port from one service to another, as well as others that will eventually access via the WireGuard VPN I have set up.

I understand that HTTPS could be problematic with the self-signed cert, but I also tried via http, I set caddy to serve http only, and the result was the same so I don't think it's currently a cert issue.

[TheDreadPirate]

So the only host you've had success connecting from, http or https, is a PC via the browser? Is this the same PC running the server? If so, is port 80 and 443 open on this host?

[mari]

Jellyfin is running on 192.168.100.100 (my truenas box).

Caddy is running on 192.168.100.31 (my PI).

I can successfully connect to Jellyfin.local (http or https) via my PC (192.168.100.5) browser but not bia the Jellyfin media player app on the same PC.

[lkadin]

If you are using https with self-signed certs, a lot of our apps will fail to connect.  Unless you add your cert to the OS's trust store.  If these will be local only connections, why bother with https?  Or caddy for that matter?

Do you intend to setup remote access via Caddy at a later time?

Caddy is simply in order to make more user friendly urls for all my services. Both for me when I'm setting things up and trying to remember the port from one service to another, as well as others that will eventually access via the WireGuard VPN I have set up.

I understand that HTTPS could be problematic with the self-signed cert, but I also tried via http, I set caddy to serve http only, and the result was the same so I don't think it's currently a cert issue.

I have the same issue without using https or self cert. It just won't connect. I even loaded a browser app on the chromecast and that connected fine.
I saw some posts about possible IP4 vs IP6 addresses but that does not seem to be it. I also saw some posts about 5G wifi vs 2.4, but don't know how to check if that is an issue.

[TheDreadPirate]

Can you share the caddy config you are currently using?

[mari]

My caddy config wasn't the issue.

I have solved it by trusting my caddy certificate in Windows as a Trusted Root Certificate. I confirmed in Wireshark that the Jellyfin client app, even when I put in http:// as the URL, and even when I set up caddy to ONLY serve HTTP, Jellyfin still tries to access HTTPS instead. It seems like the Jellyfin client does not accept domains that are not TLS-supported. Unfortunately, I don't think it's possible to trust a custom certificate on my smart TV. So I'll have to stick to using the IP address there. Or, getting a proper certificate, but that would mean exposing my homelab IP in my subdomain DNS records, and opening a port to allow the certbot to work, which is not ideal.