Djeex/docudjeex
1
1
Fork 0
Code Issues Pull Requests Projects Wiki Activity

Add section summary pages and make single-link admonitions clickable

Browse Source
This commit is contained in:
Djeex
2026-09-04 18:51:42 +02:00
parent f2cfa49150
commit 9c5a693281
60 changed files with 451 additions and 174 deletions
Download Patch File Download Diff File Expand all files Collapse all files
content/en/3.serveex/5.media/1.jellyfin.md
+16 -16
View File
@@ -14,9 +14,9 @@ It covers the same basics: a media library with metadata and artwork, transcodin
As always, we'll use the [linuxserver.io image](https://docs.linuxserver.io/images/docker-jellyfin).
::note
::note{to="/serveex/core/wireguard"}
Unlike Plex, Jellyfin has no cloud relay: to access your server outside your local network, you must expose it yourself (see below), or use a VPN like [Wireguard](/serveex/security/wireguard).
Unlike Plex, Jellyfin has no cloud relay: to access your server outside your local network, you must expose it yourself (see below), or use a VPN like **Wireguard**.
::
## Install Jellyfin
@@ -100,9 +100,9 @@ GUID=1000
Deploy the stack. The local interface is available at `http://yourserverip:8096`.
::note
::note{to="https://docs.linuxserver.io/images/docker-jellyfin/#hardware-acceleration"}
The `/dev/dri` device is only needed for hardware-accelerated transcoding on Intel/AMD GPUs. Remove it if your server doesn't have one, or adapt it for an NVIDIA GPU following [linuxserver.io's documentation](https://docs.linuxserver.io/images/docker-jellyfin/#hardware-acceleration).
The `/dev/dri` device is only needed for hardware-accelerated transcoding on Intel/AMD GPUs. Remove it if your server doesn't have one, or adapt it for an NVIDIA GPU following **linuxserver.io's documentation**.
::
### Done !
@@ -116,9 +116,9 @@ On first visit, Jellyfin walks you through a setup wizard:
And that's it! Add your media to `/media/movies` and `/media/tvseries` on your server. See below to start watching, at home or remotely.
::note
::note{to="/general/networking/samba"}
If your media is stored on a network disk (e.g. NAS or external hard drive over the network), refer to the [Samba mount guide](/general/networking/samba) so Jellyfin can access it.
If your media is stored on a network disk (e.g. NAS or external hard drive over the network), refer to the **Samba mount guide** so Jellyfin can access it.
::
## Hardware Transcoding
@@ -127,8 +127,8 @@ Jellyfin re-encodes video on the fly whenever a client can't play a file as-is:
**Tone mapping** is a related, separate feature: converting HDR video (which needs a compatible HDR display to look right) down to SDR so it displays correctly on a screen, TV, or client that doesn't support HDR, instead of looking washed out or overly dark.
::note
This only applies to Intel (and some AMD) integrated GPUs passed through with `/dev/dri`, already included in this guide's `compose.yaml`. NVIDIA GPUs need a different setup entirely, covered in [linuxserver.io's documentation](https://docs.linuxserver.io/images/docker-jellyfin/#hardware-acceleration). If your server has no compatible GPU, transcoding still works, just entirely on the CPU.
::note{to="https://docs.linuxserver.io/images/docker-jellyfin/#hardware-acceleration"}
This only applies to Intel (and some AMD) integrated GPUs passed through with `/dev/dri`, already included in this guide's `compose.yaml`. NVIDIA GPUs need a different setup entirely, covered in **linuxserver.io's documentation**. If your server has no compatible GPU, transcoding still works, just entirely on the CPU.
::
::steps{level="3"}
@@ -186,24 +186,24 @@ __If it fails:__ check your firewall rules.
## Watching Away From Home
::warning
Jellyfin won't be exposed to the internet on this site, unlike most other apps. Its native apps (phone, TV, Chromecast...) talk directly to its API rather than a browser, so a forward-auth layer like [TinyAuth](/serveex/security/tinyauth) or [Authentik](/serveex/advanced/authentik) can't sit in front of it without breaking login and playback on those clients, and Jellyfin itself has no built-in 2FA or OIDC to fall back on. So instead of exposing it, we'll reach it through the [WireGuard VPN](/serveex/security/wireguard) already set up earlier in this guide.
Jellyfin won't be exposed to the internet on this site, unlike most other apps. Its native apps (phone, TV, Chromecast...) talk directly to its API rather than a browser, so a forward-auth layer like [TinyAuth](/serveex/security/tinyauth) or [Authentik](/serveex/advanced/authentik) can't sit in front of it without breaking login and playback on those clients, and Jellyfin itself has no built-in 2FA or OIDC to fall back on. So instead of exposing it, we'll reach it through the [WireGuard VPN](/serveex/core/wireguard) already set up earlier in this guide.
::
Instead of routing a whole device's traffic through the VPN, or even the whole `10.8.0.0/24` VPN subnet, we'll use a tighter **split tunnel**: each remote device only routes traffic for your server's own VPN address through the tunnel. Everything else (browsing, other apps) stays on the device's normal connection, and the VPN is only ever used to reach that one machine.
::note
::note{to="/serveex/core/wireguard#client-server-setup"}
This assumes your Jellyfin server already runs its own WireGuard client, connecting it to your VPN as described in [Client Server Setup](/serveex/security/wireguard#client-server-setup). Note the VPN address wg-easy assigned it (e.g. `10.8.0.2`); that's the address every device below will target.
This assumes your Jellyfin server already runs its own WireGuard client, connecting it to your VPN as described in **Client Server Setup**. Note the VPN address wg-easy assigned it (e.g. `10.8.0.2`); that's the address every device below will target.
::
::caution
This split tunnel is a client-side convention, not a server-enforced security boundary: `AllowedIPs` is a routing setting, and wg-easy doesn't add any firewall rule to back it up by default. Anyone with access to a device (or its `.conf` file) could edit `AllowedIPs` back to something broader and reach whatever else your WireGuard server can route to, including other connected peers. If a peer is one of your own devices, that's usually an acceptable risk. If you're handing a peer to a third party (a friend, family member) who should only ever reach Jellyfin, see [Restricting a third-party peer to just Jellyfin](#restricting-a-third-party-peer-to-just-jellyfin) below for a way to actually enforce that server-side.
::caution{to="#restricting-a-third-party-peer-to-just-jellyfin"}
This split tunnel is a client-side convention, not a server-enforced security boundary: `AllowedIPs` is a routing setting, and wg-easy doesn't add any firewall rule to back it up by default. Anyone with access to a device (or its `.conf` file) could edit `AllowedIPs` back to something broader and reach whatever else your WireGuard server can route to, including other connected peers. If a peer is one of your own devices, that's usually an acceptable risk. If you're handing a peer to a third party (a friend, family member) who should only ever reach Jellyfin, see **Restricting a third-party peer to just Jellyfin** below for a way to actually enforce that server-side.
::
::steps{level="3"}
### Create a client in wg-easy for each device
Following [Retrieve Configuration Files](/serveex/security/wireguard#retrieve-configuration-files), create one client per device (phone, computer, TV/streaming box) and download its config file.
Following [Retrieve Configuration Files](/serveex/core/wireguard#retrieve-configuration-files), create one client per device (phone, computer, TV/streaming box) and download its config file.
### Narrow the tunnel to just the server
@@ -233,12 +233,12 @@ A `.conf` file is a credential, not just a settings file: whoever has it can con
### Restricting a third-party peer to just Jellyfin
[wg-easy](/serveex/security/wireguard) (v15.3+) can enforce this itself, with a real firewall rule inside its own container rather than a client-side setting. This is the right approach when the peer belongs to someone else, not one of your own devices.
[wg-easy](/serveex/core/wireguard) (v15.3+) can enforce this itself, with a real firewall rule inside its own container rather than a client-side setting. This is the right approach when the peer belongs to someone else, not one of your own devices.
::steps{level="4"}
#### Enable the per-client firewall
In [wg-easy](/serveex/security/wireguard)'s admin panel, go to the interface settings and enable **Per-Client Firewall**. It's marked experimental, but works by generating a dedicated `iptables` chain inside the wg-easy container.
In [wg-easy](/serveex/core/wireguard)'s admin panel, go to the interface settings and enable **Per-Client Firewall**. It's marked experimental, but works by generating a dedicated `iptables` chain inside the wg-easy container.
#### Restrict the peer's allowed destination
content/en/3.serveex/5.media/2.qbittorrent.md
+7 -7
View File
@@ -193,10 +193,10 @@ Detailed info:
Once done, deploy the container.
::note
::note{to="/serveex/core/docker/#dockge"}
**Startup logs will show a temporary password for `admin` user.**
See logs in [Dockge](/serveex/core/docker/#dockge) to retrieve it, or type this command in a terminal:
See logs in **Dockge** to retrieve it, or type this command in a terminal:
```bash [Terminal]
docker logs qbittorrent 2>&1 | grep -i "temporary password"
```
@@ -224,7 +224,7 @@ When adding a download, remember to select the proper directory so Jellyfin can
::warning
Qbittorrent does not support multi-factor authentication. Exposing it to the internet may put your system at risk. Only do this if you use MFA via [TinyAuth](/serveex/security/tinyauth) or [Authentik](/serveex/advanced/authentik/). Otherwise, don’t expose it with SWAG. Use a VPN like [Wireguard](/serveex/security/wireguard) instead.
Qbittorrent does not support multi-factor authentication. Exposing it to the internet may put your system at risk. Only do this if you use MFA via [TinyAuth](/serveex/security/tinyauth) or [Authentik](/serveex/advanced/authentik/). Otherwise, don’t expose it with SWAG. Use a VPN like [Wireguard](/serveex/core/wireguard) instead.
::
To start downloads from outside your home, without a VPN, you can expose the Qbittorrent web UI.
@@ -267,8 +267,8 @@ We assume the network name is `seedbox_default`. You can confirm by checking the
Now create/edit `seedbox.subdomain.conf`.
::tip{icon=""}
✨ __Terminal-free tip:__ use [File Browser Quantum](/serveex/files/file-browser-quantum) to edit files instead of using the terminal.
::tip{icon="" to="/serveex/files/file-browser-quantum"}
✨ __Terminal-free tip:__ use **File Browser Quantum** to edit files instead of using the terminal.
::
```bash [Terminal]
@@ -406,9 +406,9 @@ server {
}
```
::note
::note{to="/serveex/security/tinyauth#exposing-tinyauth-with-swag"}
The `location /tinyauth` block runs inside SWAG's own container, so SWAG needs to be on TinyAuth's Docker network to reach it by name (`tinyauth` here). This should already be set up from [exposing TinyAuth itself](/serveex/security/tinyauth#exposing-tinyauth-with-swag). If you run into an error, double-check SWAG's compose file still has that network attached.
The `location /tinyauth` block runs inside SWAG's own container, so SWAG needs to be on TinyAuth's Docker network to reach it by name (`tinyauth` here). This should already be set up from **exposing TinyAuth itself**. If you run into an error, double-check SWAG's compose file still has that network attached.
::
::tip{icon=""}
content/en/3.serveex/5.media/3.servarr.md
+5 -5
View File
@@ -388,7 +388,7 @@ It can be useful to expose Seerr if you want to send requests from outside your
::warning
Seerr has no built-in two-factor authentication. Only expose it if you're using a secure authentication solution like [TinyAuth](/serveex/security/tinyauth) or [Authentik](/serveex/advanced/authentik). Otherwise, don't expose it with SWAG, use a VPN like [Wireguard](/serveex/security/wireguard) instead.
Seerr has no built-in two-factor authentication. Only expose it if you're using a secure authentication solution like [TinyAuth](/serveex/security/tinyauth) or [Authentik](/serveex/advanced/authentik). Otherwise, don't expose it with SWAG, use a VPN like [Wireguard](/serveex/core/wireguard) instead.
::
::note
@@ -429,8 +429,8 @@ Here we assume the Jellyfin network is named `jellyfin_default`. You can verify
Create and edit the file `films.subdomain.conf`:
::tip{icon=""}
✨ __Tip:__ you can use [File Browser Quantum](/serveex/files/file-browser-quantum) to browse and edit files instead of using terminal commands.
::tip{icon="" to="/serveex/files/file-browser-quantum"}
✨ __Tip:__ you can use **File Browser Quantum** to browse and edit files instead of using terminal commands.
::
```bash [Terminal]
@@ -591,9 +591,9 @@ server {
}
```
::note
::note{to="/serveex/security/tinyauth#exposing-tinyauth-with-swag"}
The `location /tinyauth` block runs inside SWAG's own container, so SWAG needs to be on TinyAuth's Docker network to reach it by name (`tinyauth` here). This should already be set up from [exposing TinyAuth itself](/serveex/security/tinyauth#exposing-tinyauth-with-swag). If you run into an error, double-check SWAG's compose file still has that network attached.
The `location /tinyauth` block runs inside SWAG's own container, so SWAG needs to be on TinyAuth's Docker network to reach it by name (`tinyauth` here). This should already be set up from **exposing TinyAuth itself**. If you run into an error, double-check SWAG's compose file still has that network attached.
::
::tip{icon=""}