Caddy, fail2ban, podman

[42piper]

Hi,

so I am trying to setup jellyfin behind a reverse-proxy (caddy) and protect the login with fail2ban.

caddy and jellyfin are running as rootless podman containers in separate pods.

So far, I managed to setup caddy and access jellyfine. Great!

Before setting up fail2ban, I tried to login with wrong credentials: The log shows that but the IP is set to 10.0.2.100 (not sure what that is, some local address that all my containers have, but NOT the local IP of the machine hosting the containers). I already added 10.0.2.100 and the IP of the machine to the known-proxy list without success.

What am I missing?

Thanks!

[TheDreadPirate]

What address is the caddy using for Jellyfin? Is it using the docker IP for Jellyfin? Are you publishing ports for both containers? Or just publishing ports for caddy?

[42piper]

Jellyfins http-port is mapped to 3000. Caddy exposes 443. Caddy then uses 192.168.50.200:3000 (where the IP is the IP of the machine) to reach jellyfin.

[TheDreadPirate]

Are the pods using host networking or bridge networking? If both are using bridge networking, you can expose port 3000 on the jellyfin container and use the bridge IP. Then Jellyfin should see the caddy pod's IP, which is what you'd add to the known proxies field.

[42piper]

Since it's rootless podman, it's basically host-networking (see slirp4netns here https://github.com/containers/podman/blo...working.md).

maybe it was not clear from my post: the reverse_proxy works, I can log in and everything, but for some reason jellyfin does not detect the correct source-IP to write in the logs.

[TheDreadPirate]

You can add multiple IPs as proxies, separated with a comma. Add the host IP in addition to, I'm assuming, the Caddy container's IP.

[42piper]

I did that too.

However, figured out the problem - rootless containers in podman run in the slrip4netns network and there the source IP is not preserved / passed on.
So I need to change my setup (found some solutions via sockets), back to the drawing board.
Thanks for your help though!