IOS client connections

[forestial]

I have Jellyfin running in a Docker container on a Raspberry PI.  Local network connections to port 8096 are working well.  My media consists only of music, mostly MP3s.

I implemented Nginx Proxy Manager to allow me to access it remotely, and I set the reverse proxy up with an SSL cert to permit https access.  NPM forwards to port 8096 on the local network to the Raspberry PI.

A remote web browser connection to https://jellyfin.xxxxxxx.xxxx.net works as expected.  Then I tried three IOS clients (also remotely) with different results:

Jellyfin Remote app: Entered the above URL, but always get "Could not connect to server".  Tried it again without the https://prefix; same result.

Swiftfin IOS: Entered the above URL.  It connects, and I can see things like the local server name in the settings, but the Home screen and the All Media screen are empty - none of my media are shown.

Finamp: Entered the above URL.  It connects, loads my media and appears to be working perfectly.

I am wondering what is causing the problems for the first two clients listed.  I have a working solution with Finamp (so evidently my server, network proxy and domain settings are all good) but I'd like to try out the others.

[TheDreadPirate]

Can you share screenshots of the Nginx configuration screens? All of the tabs?

Censor your domain name. Also, I'm assuming you allowed Nginx to acquire the certs via Let's Encrypt?

[forestial]

   
The full contents of the Advanced tab are (as recommended in the Nginx section of the Jellyfin Networking docs):
# Disable buffering when the nginx proxy gets very resource heavy upon streaming
    proxy_buffering off;

    # Proxy main Jellyfin traffic
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-Protocol $scheme;
    proxy_set_header X-Forwarded-Host $http_host;
    proxy_headers_hash_max_size 2048;
    proxy_headers_hash_bucket_size 128;
   
    # Security / XSS Mitigation Headers
    # NOTE: X-Frame-Options may cause issues with the webOS app
    add_header X-Frame-Options "SAMEORIGIN";
    add_header X-XSS-Protection "0";
    add_header X-Content-Type-Options "nosniff";

    # Content Security Policy
    # See: https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP
    # Enforces https content and restricts JS/CSS to origin
    # External Javascript (such as cast_sender.js for Chromecast) must be whitelisted.
    # NOTE: The default CSP headers may cause issues with the webOS app
    #add_header Content-Security-Policy "default-src https: data: blob: http://image.tmdb.org; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' https://www.gstatic.com/cv/js/sender/v1/cast_sender.js https://www.gstatic.com/eureka/clank/95/cast_sender.js https://www.gstatic.com/eureka/clank/96/cast_sender.js https://www.gstatic.com/eureka/clank/97/cast_sender.js https://www.youtube.com blob:; worker-src 'self' blob:; connect-src 'self'; object-src 'none'; frame-ancestors 'self'";



Yes, the SSL cert was created by NPM using letsencrypt.  As mentioned, access works fine with some clients but not others.

Thanks for replying.

[TheDreadPirate]

What kind of iOS devices are you using?

[forestial]

Actually, the creation of the cert was not quite that straightforward.  My ISP blocks port 80, so the standard letsencrypt/certbot mechanism does not work.

I had to use certbot at the command line to create the cert, and (as prompted by certbot) I had to temporarily create a TXT record on my DNS service to allow this to work.  Once that was done, I attempted to create the cert again in NPM (same domain name) and it seemed to 'find' the one I had created at the command line.   Now the cert looks OK in NPM and I can successfully request its renewal there.  So I think it's good but its creation was a bit strange.

[TheDreadPirate]

When you access your Jellyfin in a browser, does the browser trust the cert?

[forestial]

When you access your Jellyfin in a browser, does the browser trust the cert?

Yes.  With Firefox it says "Connection is secure" but then "Connection verified by a certificate issuer that is not recognized by Mozilla".

With Edge it says "Connection is secure" and then "This site has a valid certificate, issued by a trusted authority"

Both of these browsers are on Windows.

I can also connect using that URL from Firefox on my iPhone and again "Connection is secure"

[forestial]

For what it's worth: I can also successfully use the Roku app on my TV, again using the same https URL mentioned above.

---

What kind of iOS devices are you using?

iPhone 12 mini running IOS 17.5.1

[theguymadmax]

Swiftfin does not support all library types. It only supports Movies, Shows, and LiveTv. Other libraries such as music, home videos & photos, and mixed movies & shows are not yet supported. If you want to access these you'll need to use the Jellyfin Mobile app from the App Store. For music only I recommend Finamp, which you are already using.

[forestial]

OK, so I will discontinue using Swiftfin.

I will post a question in the Github project for the Jellyfin Mobile app to see if they can determine why it cannot connect. Thanks for the help here.