If you’re only trying to use Jellyfin at home, you don’t need any reverse proxy or domain. All you need is for both devices to be on the same network, and for the Raspberry Pi to have a fixed internal IP address (through your router settings).

On the Shield, you just give the Jellyfin app that IP address and port number (10.0.0.X:8096) to connect and you’re good to go.

First of all, is that all correct or have I misunderstood something?

There’s a couple things you’ve got a bit wrong:

I think I’m correct in saying that mysubdomain.mydomain.com is actually an IP address and a public port, so something like 123.456.7.8:443, then Cloudflare - which is the reverse proxy - gets involved (somehow? how?) to say “ah, 123.456.7.8:443, you obviously want to go to funkless.raspberry.pi:NGINX (or rather something like 987.654.3.2:443)” and then NGINX - which is the proxy-proxy, not a reverse-proxy - goes (somehow? how?) “ah, 987.654.3.2:443, you obviously want to go to 987.654.3.2:8096 which is jellyfin”)

I’m not sure what Cloudflare product you’re using, but I use it as a DNS server for my domain. If you’re doing the same thing - you’ll have configured A records and such if so - then what’s happening is this:

1. You request subdomain.mydomain.com. Your device needs the IP to connect to, so it asks Cloudflare for the IP address. Think of this like calling information to find a phone number.
2. Then your device initiates a request to the IP address it gets back. This is where TLS gets used, and encrypts your connection to that IP address. It also includes the domain requested in a header for the request.
3. Nginx (which is a reverse proxy, meaning it handles incoming rather than outgoing connections) receives the connection and looks at the domain header. Then it looks in its configuration for the IP and port it should connect to, and forwards the request

However, if you’re using some other thing at Cloudflare to make a VPN this might be entirely wrong.

How does mysubdomain.mydomain.com know it’s me and not some random or bot?

Unless you’ve implemented some kind of filtering or authentication in Nginx, it doesn’t. I got around this by configuring HAProxy - which is like Nginx - to only allow requests from my local network except for specific domains that I want to be public.

Is this step “port forwarding” or “opening ports” or “exposing ports” or either or both? (I don’t understand these terms)

Exposing or opening ports is something you do with a firewall. The purpose of Nginx is to make it so you only have to open 1-2 ports, and Nginx will handle redirecting traffic based on its configuration.

If my browser when accessing mysubdomain.mydomain.com is always going to port 80/443, does it need to be told it’s going to talk to cloudflare - if so how? - and does cloudflare need to be told it’s going to talk to NGINX on my local machine - if so how?

If you’re using Cloudflare like I described above, you will only need to tell Cloudflare the public IP address of your Nginx server. Generally you do this by telling your domain registrar (where you buy domain.com) to use Cloudflare’s “nameservers” and then configure Cloudflare to point to your public IP address.

How do I tell NGINX to switch from local:443 to local:8096 (assuming I’ve understood this correctly)

You edit the Nginx config to add something like this:

server {
    server_name subdomain1.example.com;
    location / {
        proxy_pass       http://hostname1:port1;
    }
 }

Then, when Nginx receives a connection request for subdomain1.example.com for any location, it will proxy it to the configured hostname (or IP address) and port.

Is there a difference between an SSL cert and a public and private key - are they three things, two things or one thing?

There are two parts to an SSL cert: A public key and a private key. How SSL works is… complicated, but suffice to say the public key is shared with the connection, and the private key is hidden on the server. You can encrypt data with either one, and only the matching key can decrypt it. This allows both sides to trust the connection and for nobody else to see the data.

Doesn’t a VPN add an extra step of fuckery to this and how do I tell the VPN to allow all this traffic switching without blocking it and without showing the world what I’m doing?

The Internet is like an ogre: It has layers. HTTP and DNS are on one layer, VPNs are a different layer. HTTP and DNS traffic can travel over the Internet, or your local network or over the VPN.

If you’re just setting up a local Jellyfin server, you technically don’t need Cloudflare. Your home router will probably let you hard-code a DNS entry for a local IP address, which will keep all of that traffic on your local network. And if you do that right you won’t even need SSL.

Gluetun just looks like a text document to me (compose.yml) - how do I know it’s actually protecting me?

I’m not familiar with how Gluetun works, but it’s not just compose.yml. When you start it with docker-compose run it will download and extract the code to run Gluetun, and configure networking and other things.

Lots of people contributed really good answers, so I don’t have anything valuable to add to their answers. But I wanted to point out for your detailed question, you include what you have done, what is your understanding and what are your shortcomings clearly. As opposed to a lot of posts with vague, detail-challenged narratives, that’s a top notch post.

And the community delivered by giving good answers, so go community!

Also, you didn’t just ghost after the initial post and interacted.with the people who graciously donated their time, so another bonus point there, as well.

A lot of this is being complicated for you by not understanding networking fundamentals. I’d suggest looking into a Network+ certification which will cover all of these basics like DNS. You don’t have to actually get the cert, just going through the motions on learning the material should help a lot.

You seem to be close on grokking the whole picture and just need some of the basics that are hard to pick up from just doing things at home. A lot of work has been done to try abstract that away from consumers in order to make things easier which is making it harder for you.

As others have mentioned (and also explained in quite some detail) you’re trying to bite off a lot at once. First, for Jellyfin locally you can ignore most of that.

And if you really want to learn the ins and outs of all that (and I can recommend it, it’s useful), then I suggest you start with some simple web app. Something like note taking or maybe even something trivial like a whoami service, which basically just echos some information it was sent back to you. That’s super useful because you know that it is unlikely to be broken, so you can focus on the networking/port forwarding issues. And once you’ve got that working and have a rough feeling how this all works you can go on to more complex setups that actually do something useful.

Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:

[Thread #458 for this sub, first seen 28th Jan 2024, 18:55] [FAQ] [Full list] [Contact] [Source code]

Tons of good responses here. I’m surprised that nobody has brought up Tailscale though. It’s def the easiest vpn solution I have found. It’s got some great documentation and how to projects to get a home lab running and it’s got its own domain system baked in most of it being zero configuration. You can access mullvad vpn exit nodes straight from it, and set up those domains with ssl super easy e.g.

sudo tailscale serve —https=443 localhost:8096

That single command would allow any other devices connected to your Tailscale account to reach your Jellyfin using the domain “{serverhostname}.[tail-scale].ts.net” complete with a private reverse proxy and ssl cert.

There are a few things to click around in tailscale on but it’s a extremely easy to use free application that has made my self hosted life significantly easier due to my system living behind multiple firewalls that I sadly have no control over.

If you get a reverse proxy setup all you need is port 80 and 443 and configure it it’ll expose the services that you want to be exposed through the subdomain Personally I’ve got Traefik service sitting on my media server and anything I want to expose goes through it .it has the details for the connection to cloudflare and so long as I direct it properly both on the container side and Traefik it’ll run as expected. The idea is if you go to say jellyfin.example.com cloudflare will direct that at at your reverse proxy(nginx in this case) which then redirects to the right machine/container because you entered from “jellyfin” .

The VPN gluten it is another container that will have the login details to your provider .

I’m still working my way through the self hosted rabbit hole myself, however I used a combination of Google and this sitehttps://www.smarthomebeginner.com/traefik-docker-compose-guide-2022/ The entire site not just the specific article linked . As well as https://trash-guides.info/