SOLVED: Severe stuttering via reverse proxy (nginx)

[Matth]

So, I have this issue that bugs me massively and I can't seem to figure out what the problem is. 

I have Jellyfin 10.11.10 running in a docker container on an Intel NUC running Ubuntu 22.04.5 LTS. Content is coming from a mounted volume from a NAS.

Jellyfin has plenty of content in all different qualities. When I connect directly to the server, i.e. 192.168.7.8:8096 I can stream all content perfectly fine and without a stutter. Full HD as well as various 4K content all running perfectly fine on my phone. When I run these movies or TV shows, the dashboard says it doesn't have to transcode, and simply feeds the file as it is.

I also have an nginx reverse proxy setup. This one has port 80 and 443 open so that I can access Jellyfin (and other self-hosted services) from outside my home. My nginx conf is literally a copy from the sample on the Jellyfin website (https://jellyfin.org/docs/general/post-i...roxy/nginx). 

Here is my copy of it:

Code:

server {

    server_name jellyfin.mydomain.com;

    ## The default `client_max_body_size` is 1M, this might not be enough for some posters, etc.
    client_max_body_size 20M;

    # use a variable to store the upstream proxy
    set $jellyfin 192.168.7.8;

    # Security / XSS Mitigation Headers
    add_header X-Content-Type-Options "nosniff";

    # Permissions policy. May cause issues with some clients
    add_header Permissions-Policy "accelerometer=(), ambient-light-sensor=(), battery=(), bluetooth=(), camera=(), clipboard-read=(), display-capture=(), document-domain=(), encrypted-media=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), i>

    # Content Security Policy
    # See: https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP
    # Enforces https content and restricts JS/CSS to origin
    # External Javascript (such as cast_sender.js for Chromecast) must be whitelisted.
    add_header Content-Security-Policy "default-src https: data: blob: ; img-src 'self' https://* ; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' https://www.gstatic.com https://www.youtube.com blob:; worker-src 'self' blob>

    location / {
        # Proxy main Jellyfin traffic
        proxy_pass http://$jellyfin:8096;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-Protocol $scheme;
        proxy_set_header X-Forwarded-Host $http_host;

        # Disable buffering when the nginx proxy gets very resource heavy upon streaming
        proxy_buffering off;
    }

    location /socket {
        # Proxy Jellyfin Websockets traffic
        proxy_pass http://$jellyfin:8096;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-Protocol $scheme;
        proxy_set_header X-Forwarded-Host $http_host;
    }

    access_log /var/log/nginx/jellyfin.mydomain.com-access.log;
    error_log /var/log/nginx/jellyfin.mydomain.com-error.log info;

    listen 443 ssl; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/jellyfin.mydomain.com/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/jellyfin.mydomain.com/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

}
server {
    if ($host = jellyfin.mydomain.com) {
        return 301 https://$host$request_uri;
    } # managed by Certbot

    listen 80 http2;

    server_name jellyfin.mydomain.com;
    return 404; # managed by Certbot

}

Now when I connect through the proxy (https://jellfyin.mydomain.com/) I can access my home page just fine and browse all the media. When I try to play some HD content, it usually plays quite fine. However, when I try to play the very same 4K content that works fine via the direct connection, it stutters and plays half a second every 60-90 seconds. In the dashboard it still "Direct playing - the source file is entirely compatible with this client and the session is receiving the file without modifications.

However, in the docker logs I see this:

Code:

[13:56:03] [INF] [20] Jellyfin.Api.Helpers.MediaInfoHelper: User policy for matth. EnablePlaybackRemuxing: True EnableVideoPlaybackTranscoding: True EnableAudioPlaybackTranscoding: True

The server itself is mostly idle and doesn't show any other activity that would have an influence.

I tried different clients. The original Jellyfin Android app, as well as Streamyfin, the problem persists in both. The only difference I can figure out so far is nginx that seems to be the bottle-neck. The proxy also runs on the same machine as Jellyfin, has a 1Gbit/s network connection.

I'm really at a loss and wonder if there is any tips you could provide as to what I can try to fix it.

My Networking settings on the server should also be fine:



(The mydomain.com is obviously a placeholder for my real domain)

[TheDreadPirate]

Does this issue happen even when you are on the same network as the server? If so, you need to enable NAT loopback or setup custom DNS entries in your router so that your domain name resolves to your LAN IP instead of your WAN IP. What I THINK is going on is that your local connection attempts via your domain name are being routed out to the Internet and then coming directly back.

Enabling NAT loopback or custom DNS entries would prevent this while you are on your home network.

When you are NOT on your home network, do you have issues with stuttering with 4K content?

[Matth]

Yes, NAT loopback is enabled on the router.

I also pointed the domain jellyfin.mydomain.com directly to the proxy server on my Pihole. So the mobile phone gets that DNS from the Pihole.

And yes, it stutters both at home when I'm on the same network, as well as when I'm on the mobile network.

[TheDreadPirate]

So your proxy is running on your pihole host? What model RPi?

[Matth]

No, the proxy is running on the same machine as Jellyfin is running on. The Pihole is on a Raspberry Pi 5, but is a different machine.

[TheDreadPirate]

No, the proxy is running on the same machine as Jellyfin is running on. The Pihole is on a Raspberry Pi 5, but is a different machine.

Can you try changing this line in your nginx config?

From:

Code:

    set $jellyfin 192.168.7.8;

To:

Code:

    set $jellyfin localhost;

[Matth]

That will definitely not work. While the proxy and the Jellyfin container are on the same physical machine, the proxy is run as a Virtual Machine on VirtualBox.

The physical server has the IP 192.168.7.8, while the proxy's IP is 192.168.7.26.

[TheDreadPirate]

Is the VM only running the proxy? What is the reasoning for having the proxy in a VM?

[Matth]

I installed the proxy a couple of years ago and at that time it seemed to be a reasonable way to keep it separate. I'd probably prefer to run it in a docker container if I did that again.

And yes, the VM is only running the reverse proxy and a few static web pages I use as a local dashboard. Nothing else. The proxy runs on Ubuntu 24.04.4 LTS.

[TheDreadPirate]

For testing, can you run a proxy either directly in the OS running Jellyfin or in a container? The only thing that makes sense is that the routing between the host and VM is wonky and traffic is taking an unnecessarily long/slow route.