Hey y’all, this may be a better question for [r/homelab](r/homelab), but I want to make sure I’m not missing anything software-side with my current setup. I also want to preface that everything is currently functioning on both LAN and WAN.
Internally, I have Caddy + Pi-hole handling local DNS and reverse proxying all of my services. So, on the LAN, mc.[domainName].com takes me to one of the minecraft servers, with similar subdomains for the other services.
Externally, I have a second Caddy instance with some additional restrictions. It accepts and forwards web traffic to my Jellyfin instance via jelly.\[domainName\].com. This connection is geofenced to the US only.
All SSH access across the lab is restricted to the LAN.
The public-facing Jellyfin accounts (GF, her family, etc.) are allowed remote access but are hidden from the login screen by default. My family’s accounts are not allowed remote access but appear automatically on the login screen(on LAN). All accounts have passwords and are set to lock out after a maximum of 10 failed attempts.
Everything seemingly works as intended. I still need to work on some bandwidth/streaming limits and pass my GPU through to the Jellyfin instance, but both LAN and WAN streaming work, including concurrent streams.
Am I missing anything obvious from a security standpoint? Or general QoL?
Source: r/jellyfin · by /u/KingOfWhateverr