Access your Jellyfin anywhere with Caddy

[Fantomas43]

Hello,

I read a lot about the domain settings. I cannot separate between the duckdnx example and mine.

So my questions are:

If xxxx.com belongs to me and I want to access jellyfin over "jellyfin.xxxx.com"
should it look like this?:

Code:

caddy reverse-proxy --from jellyfin.xxxx.com --to 127.0.0.1:8096

Is that right?

2. Does HTTPS need to be enabled in Jellyfin, or does the reverse proxy do that automatically?


Thx for help
Fantomas43

[Duvel]

Hello,

I read a lot about the domain settings. I cannot separate between the duckdnx example and mine.

So my questions are:

If xxxx.com belongs to me and I want to access jellyfin over "jellyfin.xxxx.com"
should it look like this?:

Code:

caddy reverse-proxy --from jellyfin.xxxx.com --to 127.0.0.1:8096

Is that right?

2. Does HTTPS need to be enabled in Jellyfin, or does the reverse proxy do that automatically?


Thx for help
Fantomas43

Answering 2 first : you should not activate HTTPS on Jellyfin. HTTPS is the job of your Caddy. So everything that is in the web is encrypted by caddy, and everything in your LAN after caddy, is not encrypted (http).

For 1, this is called a subdomain. 
First, the most important is that you should have ordered a WILDCARD certificate, so you can just create any subdomain for your domain name.
You can read this for lets encrypt https://www.codestudy.net/blog/multiple-...s-encrypt/
* If it is not the case, you have to reorder a new cert with wildcard.
* If that is the case, this is how your Caddyfile would look like for subdomain proxying :

Code:

*.yourdomain.com, yourdomain.com {
        # your route/tls stuff goes here
        #-------------------
        # JELLYFIN subdomain
        @jellyfin host jellyfin.yourdomain.com
        handle @jellyfin {
                route {
                        reverse_proxy 192.168.2.4:8096 #Adapt this to your Jellyfin server's IP/Port
                }
        }
}

As simple as that. And you can create any subdomains you want, just by defining this block in your caddyfile, pointing to any of your LAN's IP:port applications.

[Fantomas43]

Thank you for the fast answer. I'm happy to see the answer for my second question, but the configuration of caddy seems much more complicated to me in comparism to the Jeellyfin-Networking guide as I posted in my example.

I will have a look and test some things.

[Vitosi4ek]

Not sure if anyone here's living in a region where it's possible, but I use a router from a rather small/niche company called Keenetic. They're originally Russian, but have embarked on a marketing push in Europe/MENA recently. Their hardware is so-so for the price, but their biggest selling point is the software. And one of their big features is that they give you a 3rd-level domain (so it's [custom_name].keenetic.link usually) with the purchase of a router, and the software has a one-click interface for configuring reverse proxies - you literally just specify the name, the device/port you want to proxy, and it does everything - DNS, HTTPS certs etc - for you.

While it vendor-locks you to that manufacturer since the domain is tied to the router, I've never seen this process *just work* to this extent.

[Fantomas43]

OK, I am unable to make a right entry.

I have Caddy and Jellyfin running on the same Machine (raspberry):
So the entry for the IP should be "127.0.0.1:8096" so like: reverse_proxy 192.168.2.4:8096

My dyndns is from No-iP a subdomain:

So it is like: jellyfin.xxxx.net

Code:

surfer.xxxx.net {
    # Reverse proxy to Jellyfin's internal address and port
    reverse_proxy 127.0.0.1:8096
}

I get: Error: loading initial config: loading new config: starting caddy administration endpoint: listen tcp 127.0.0.1:2019: bind: address already in use

Would someone be so kind to post his Caddyconfiguartion with Jellyfin/ Raspberry / Caddy? I do not use docker. Raspberry is headless.

Thank you

[pxr5]

^ Have you opened the necessary ports to your Pi, try 80 and 443? Is there anything running on either of those ports?. Check your Caddyfile - don't use the spacebar to shift lines across, instead use tabs, you may have spaces instead of tabs in the second line. Run 'caddy fmt --overwrite' to check the Caddyfile.

This is my Caddy file running on a Pi, JF is on another device.

Code:

xxxxx.yyyy.zzz {
    reverse_proxy 192.168.1.xx:8096
}

[Fantomas43]

Yes, I am now a bit further, I opened the port and have the next problem

Code:

Jan 19 17:13:09 xxxxx caddy[829]: {"level":"error","ts":1768839189.8486156,"logger":"tls.obtain","msg":"could not get certificate from issuer","identifier":"xxxxx.ddns.net","issuer":"acme-v02.api.letsencrypt.org-directory","error":"HTTP 400 urn:ietf:params:acme:error:connection - 92.116.66.18: Fetching http://xxxxx.ddns.net/.well-known/acme-challenge/SUyR4Tek4Pgjs6dXAsz3D1HE5qVIvSsRRvzY9moefNc: Error getting validation data"}
Jan 19 17:13:09 xxxxx caddy[829]: {"level":"error","ts":1768839189.8487456,"logger":"tls.obtain","msg":"will retry","error":"[xxxxx.ddns.net] Obtain: [xxxxx.ddns.net] solving challenge: xxxxx.ddns.net: [xxxxx.ddns.net] authorization failed: HTTP 400 urn:ietf:params:acme:error:connection - 92.116.66.18: Fetching http://xxxxx.ddns.net/.well-known/acme-challenge/SUyR4Tek4Pgjs6dXAsz3D1HE5qVIvSsRRvzY9moefNc: Error getting validation data (ca=https://acme-staging-v02.api.letsencrypt.org/directory)","attempt":3,"retrying_in":120,"elapsed":189.998216537,"max_duration":2592000}

The ports are open over the Router and not blocked by firewall of the raspberry I will have another check regarding this

[Fantomas43]

OK, i have a question.

The command:

Code:

sudo caddy reverse-proxy --from xxxxx.ddns.net --to 127.0.0.1:8096

WORKS!!!

but how does it work with caddy, when it starts normal from reboot. it seems to be a permission problem I had

So, how to I add this information in the caddy file?
"sudo" seems to be crucial difference

Here
https://jellyfin.org/docs/general/post-i...oxy/caddy/
is the command without sudo

[pxr5]

Maybe the commands in the link are in su mode. I set Caddy to start at boot and it just does its thing in the background:

Code:

sudo systemctl start caddy.service

And accordingly

Code:

sudo systemctl stop caddy.service

[entraptaa]

I'm trying to follow this tutorial myself but it seems that my ISP AT&T blocks the ports 80 and 443 and Caddy will always have problems solving the lets encrypt challenge. Any idea on what I can do?