Djeex/docudjeex
1
1
Fork 0
Code Issues Pull Requests Projects Wiki Activity

Add section summary pages and make single-link admonitions clickable

Browse Source
This commit is contained in:
Djeex
2026-09-04 18:51:42 +02:00
parent f2cfa49150
commit 9c5a693281
60 changed files with 451 additions and 174 deletions
Download Patch File Download Diff File Expand all files Collapse all files
content/en/3.serveex/5.media/1.jellyfin.md
+16 -16
View File
@@ -14,9 +14,9 @@ It covers the same basics: a media library with metadata and artwork, transcodin
As always, we'll use the [linuxserver.io image](https://docs.linuxserver.io/images/docker-jellyfin).
::note
::note{to="/serveex/core/wireguard"}
Unlike Plex, Jellyfin has no cloud relay: to access your server outside your local network, you must expose it yourself (see below), or use a VPN like [Wireguard](/serveex/security/wireguard).
Unlike Plex, Jellyfin has no cloud relay: to access your server outside your local network, you must expose it yourself (see below), or use a VPN like **Wireguard**.
::
## Install Jellyfin
@@ -100,9 +100,9 @@ GUID=1000
Deploy the stack. The local interface is available at `http://yourserverip:8096`.
::note
::note{to="https://docs.linuxserver.io/images/docker-jellyfin/#hardware-acceleration"}
The `/dev/dri` device is only needed for hardware-accelerated transcoding on Intel/AMD GPUs. Remove it if your server doesn't have one, or adapt it for an NVIDIA GPU following [linuxserver.io's documentation](https://docs.linuxserver.io/images/docker-jellyfin/#hardware-acceleration).
The `/dev/dri` device is only needed for hardware-accelerated transcoding on Intel/AMD GPUs. Remove it if your server doesn't have one, or adapt it for an NVIDIA GPU following **linuxserver.io's documentation**.
::
### Done !
@@ -116,9 +116,9 @@ On first visit, Jellyfin walks you through a setup wizard:
And that's it! Add your media to `/media/movies` and `/media/tvseries` on your server. See below to start watching, at home or remotely.
::note
::note{to="/general/networking/samba"}
If your media is stored on a network disk (e.g. NAS or external hard drive over the network), refer to the [Samba mount guide](/general/networking/samba) so Jellyfin can access it.
If your media is stored on a network disk (e.g. NAS or external hard drive over the network), refer to the **Samba mount guide** so Jellyfin can access it.
::
## Hardware Transcoding
@@ -127,8 +127,8 @@ Jellyfin re-encodes video on the fly whenever a client can't play a file as-is:
**Tone mapping** is a related, separate feature: converting HDR video (which needs a compatible HDR display to look right) down to SDR so it displays correctly on a screen, TV, or client that doesn't support HDR, instead of looking washed out or overly dark.
::note
This only applies to Intel (and some AMD) integrated GPUs passed through with `/dev/dri`, already included in this guide's `compose.yaml`. NVIDIA GPUs need a different setup entirely, covered in [linuxserver.io's documentation](https://docs.linuxserver.io/images/docker-jellyfin/#hardware-acceleration). If your server has no compatible GPU, transcoding still works, just entirely on the CPU.
::note{to="https://docs.linuxserver.io/images/docker-jellyfin/#hardware-acceleration"}
This only applies to Intel (and some AMD) integrated GPUs passed through with `/dev/dri`, already included in this guide's `compose.yaml`. NVIDIA GPUs need a different setup entirely, covered in **linuxserver.io's documentation**. If your server has no compatible GPU, transcoding still works, just entirely on the CPU.
::
::steps{level="3"}
@@ -186,24 +186,24 @@ __If it fails:__ check your firewall rules.
## Watching Away From Home
::warning
Jellyfin won't be exposed to the internet on this site, unlike most other apps. Its native apps (phone, TV, Chromecast...) talk directly to its API rather than a browser, so a forward-auth layer like [TinyAuth](/serveex/security/tinyauth) or [Authentik](/serveex/advanced/authentik) can't sit in front of it without breaking login and playback on those clients, and Jellyfin itself has no built-in 2FA or OIDC to fall back on. So instead of exposing it, we'll reach it through the [WireGuard VPN](/serveex/security/wireguard) already set up earlier in this guide.
Jellyfin won't be exposed to the internet on this site, unlike most other apps. Its native apps (phone, TV, Chromecast...) talk directly to its API rather than a browser, so a forward-auth layer like [TinyAuth](/serveex/security/tinyauth) or [Authentik](/serveex/advanced/authentik) can't sit in front of it without breaking login and playback on those clients, and Jellyfin itself has no built-in 2FA or OIDC to fall back on. So instead of exposing it, we'll reach it through the [WireGuard VPN](/serveex/core/wireguard) already set up earlier in this guide.
::
Instead of routing a whole device's traffic through the VPN, or even the whole `10.8.0.0/24` VPN subnet, we'll use a tighter **split tunnel**: each remote device only routes traffic for your server's own VPN address through the tunnel. Everything else (browsing, other apps) stays on the device's normal connection, and the VPN is only ever used to reach that one machine.
::note
::note{to="/serveex/core/wireguard#client-server-setup"}
This assumes your Jellyfin server already runs its own WireGuard client, connecting it to your VPN as described in [Client Server Setup](/serveex/security/wireguard#client-server-setup). Note the VPN address wg-easy assigned it (e.g. `10.8.0.2`); that's the address every device below will target.
This assumes your Jellyfin server already runs its own WireGuard client, connecting it to your VPN as described in **Client Server Setup**. Note the VPN address wg-easy assigned it (e.g. `10.8.0.2`); that's the address every device below will target.
::
::caution
This split tunnel is a client-side convention, not a server-enforced security boundary: `AllowedIPs` is a routing setting, and wg-easy doesn't add any firewall rule to back it up by default. Anyone with access to a device (or its `.conf` file) could edit `AllowedIPs` back to something broader and reach whatever else your WireGuard server can route to, including other connected peers. If a peer is one of your own devices, that's usually an acceptable risk. If you're handing a peer to a third party (a friend, family member) who should only ever reach Jellyfin, see [Restricting a third-party peer to just Jellyfin](#restricting-a-third-party-peer-to-just-jellyfin) below for a way to actually enforce that server-side.
::caution{to="#restricting-a-third-party-peer-to-just-jellyfin"}
This split tunnel is a client-side convention, not a server-enforced security boundary: `AllowedIPs` is a routing setting, and wg-easy doesn't add any firewall rule to back it up by default. Anyone with access to a device (or its `.conf` file) could edit `AllowedIPs` back to something broader and reach whatever else your WireGuard server can route to, including other connected peers. If a peer is one of your own devices, that's usually an acceptable risk. If you're handing a peer to a third party (a friend, family member) who should only ever reach Jellyfin, see **Restricting a third-party peer to just Jellyfin** below for a way to actually enforce that server-side.
::
::steps{level="3"}
### Create a client in wg-easy for each device
Following [Retrieve Configuration Files](/serveex/security/wireguard#retrieve-configuration-files), create one client per device (phone, computer, TV/streaming box) and download its config file.
Following [Retrieve Configuration Files](/serveex/core/wireguard#retrieve-configuration-files), create one client per device (phone, computer, TV/streaming box) and download its config file.
### Narrow the tunnel to just the server
@@ -233,12 +233,12 @@ A `.conf` file is a credential, not just a settings file: whoever has it can con
### Restricting a third-party peer to just Jellyfin
[wg-easy](/serveex/security/wireguard) (v15.3+) can enforce this itself, with a real firewall rule inside its own container rather than a client-side setting. This is the right approach when the peer belongs to someone else, not one of your own devices.
[wg-easy](/serveex/core/wireguard) (v15.3+) can enforce this itself, with a real firewall rule inside its own container rather than a client-side setting. This is the right approach when the peer belongs to someone else, not one of your own devices.
::steps{level="4"}
#### Enable the per-client firewall
In [wg-easy](/serveex/security/wireguard)'s admin panel, go to the interface settings and enable **Per-Client Firewall**. It's marked experimental, but works by generating a dedicated `iptables` chain inside the wg-easy container.
In [wg-easy](/serveex/core/wireguard)'s admin panel, go to the interface settings and enable **Per-Client Firewall**. It's marked experimental, but works by generating a dedicated `iptables` chain inside the wg-easy container.
#### Restrict the peer's allowed destination