Selfhosted

To be totally honest I didn’t read your entire post, but just from your intro I think we are in similar situations. ISP router, low costs, using only the hardware you have around. I’ve solved a lot of stuff with Tailscale. None of my services are public facing and instead I connect to them over Tailscale (could be replaced with wireguard).

The wall I’m hitting you or maybe others could help with, is accessing my services from sub domains of a single Tailscale address rather than having to type port numbers for everything. I know this involves a reverse proxy and DNS (I use PiHole for that), but I’m stuck trying to configure the two in a way that actually works. Once I finally ditch iOS for good I’ll probably just sync a hosts file between all my devices using Syncthing to help streamline the DNS situation.

and Android devices only have one VPN slot enabled, I cannot use something such as Tailscale for encryption.

I solved a similar situation with a tailscale subnet router . a tailscale subnet router is a tailscale node that exposes the non-tailscale network to the tailscale network. This way I am able to access one of my routers (and its PBX) from all tailscale nodes. The android phone has only tailscale as a VPN. If i pay for mulvad I can have the rest of the traffic go over a mullvad node.

doesn't really help you here though, unless you install protonVPN on the pi and add that as a tailscale exit node.

One thing that I haven't seen anyone mention yet, in this post or the last one, how to you plan on aquiring videos for your server? If you plan on torrenting, you just have to pay for a vpn, Proton doesn't allow you to make p2p connections like that on a free account

Wow, there isn’t a single solution in here with the obvious answer?

You’ll need a domain name. It doesn’t need to be paid - you can use DuckDNS. Note that whoever hosts your DNS needs to support dynamic DNS. I use Cloudflare for this for free (not their other services) even though I bought my domains from Namecheap.

Then, you can either set up Let’s Encrypt on device and have it generate certs in a location Jellyfin knows about (not sure what this entails exactly, as I don’t use this approach) or you can do what I do:

1. Set up a reverse proxy - I use Traefik but there are a few other solid options - and configure it to use Let’s Encrypt and your domain name.
2. Your reverse proxy should have ports 443 and 80 exposed, but should upgrade http requests to https.
3. Add Jellyfin as a service and route in your reverse proxy’s config.

On your router, forward port 443 to the outbound secure port from your PI (which for simplicity’s sake should also be port 443). You likely also need to forward port 80 in order to verify Let’s Encrypt.

If you want to use Jellyfin while on your network and your router doesn’t support NAT loopback requests, then you can use the server’s IP address and expose Jellyfin’s HTTP ports (e.g., 8080) - just make sure to not forward those ports from the router. You’ll have local unencrypted transfers if you do this, though.

Make sure you have secure passwords in Jellyfin. Note that you are vulnerable to a Jellyfin or Traefik vulnerability if one is found, so make sure to keep your software updated.

If you use Docker, I can share some config info with you on how to set this all up with Traefik, Jellyfin, and a dynamic dns services all up with docker-compose services.

Here's an idea: on your android device use something like Insular to create a work profile, that way you get its own VPN slot, add your selfhosted-related apps there along with Tailscale. You can keep ProtonVPN on for your other apps, while using TS for your "LAN away from home" stuff. Since Tailscale already encrypts all traffic, you don't have to worry about HTTPS, certs, et al.

How about creating your own LAN within the untrusted network?

Something like an inexpensive OpenWRT router would do fine. Connect all your devices and the server to the router. They are now on a trusted network. Set up Wireguard on the OpenWRT router to connect to Proton so that your outbound traffic from all your devices is secured.

A lot of people have suggested Tailscale and it's basically the perfect solution to all your requirements.

You keep saying you need ProtonVPN which means you can't use Tailscale, but Tailscale actually supports setting up an exit node which is what you need. Put Protonvpn on the Raspberry Pi, then set it up as an exit node for your tailnet. There's a lot of people talking about how they did this online. It looks like they even have native support for bypassing the manual setup if you use Mullvad.

As long as every client has the ability to use Tailscale (I.e. no weird TVs or anything) this seems like it checks all your boxes. And since everything is E2EE from Tailscale, TLS is redundant and you can just use HTTP.

Hi again.

How about the following idea:

Set up ProtonVPN on the raspberry pi.

On all other devices (or at least those you want to use Jellyfin on), switch from using Proton to using Wireguard. Unlike your phone, the raspberry pi has no trouble running multiple VPNs. I think the ProtonVPN limitations in regard to not allowing split tunneling don't apply here, since all outgoing traffic will still go via Proton.

Essentially, the Pi would function as a proxy for all of your traffic, "and also" host Jellyfin. You would still connect to http://192.168.20.10:8096/ (or whatever) on your devices, but that address would only resolve to anything when you are connected to the pi via Wireguard. No HTTPs, but "HTTP over Wireguard", if you will.

Nots that this requires you trusting the pi to the same degree that you trust your phone.

For your static devices (PC, TV) this should solve the problem. Devices which you take with you, like your phone, unfortunately will loose internet connectivity when you leave your home until you switch off Wireguard, and switch on Proton, and not be able to connect to Jellyfin when you return home, until you switch them back.

Essentially, you would have a "home" VPN and a "on the go" VPN, though you never need to connect to both. There might be ways to automate this based on WiFi SSID on Android, but I have not looked into it.

The Pros:

• this should meet all your requirements. No additional expenses, no domain, no dynDNS; no selfsigned certificate or custom CA; traffic is never unencrypted; works on all common devices.
• Wireguard is sufficiently lightweight to not bog down the pi, normally
• this is actually well within the intended use-cases for Wireguard, so no "black magic" required in configuring it
• if you ever do decide to get a domain, you can configure everything to always be connected to your pi via Wireguard, even on the go! Not required though.

The Cons:

• when you are new to selfhosting, Wireguard is a bit daunting to set up. It is not the easiest to debug (don't worry, it's easy to tell IF it is working, but not always WHY it isn't working). Some manual route handling is probably also required on the pi. It should definitely be doable though, but might turn this Jellyfin thing from a weekend project to a 2 week project...
• I have no experience with how well the pi runs Jellyfin. If the answer is "barely", then adding multiple concurrent Wireguard sessions might be a bad experience. Though in this case, you could only switch Proton to Wireguard whenever you want to watch Jellyfin.
• the manual switching might be annoying, but that is the price to pay here, so to speak

Edit: someone else already mentioned setting up your own trusted network with a second router. IMO that is the better, more hassle-free option IF you are willing to shell out the money. My suggestion is the "free" version of that, essentially 😄

ProtonVPN in its free tier does not allow LAN connections

This is the limiting factor. In order to get around this, you'll have to put your Jellyfin server on the Internet. Hopefully you can enable port forwarding. If not, you have painted yourself into a corner.

If you cannot use self-signed or internal CA certs, you will also need a domain name, and something like Let's Encrypt to issue certs for that domain.

I read the old thread and now this one.

As I understand it, you want to create connection between clients on your lan, but you don't trust your lan, so it's like having a raspberry pi server and some client both on the coffee shop network and you want them to communicate securely?

Tailscale is what you want. Easy setup, free, and allows exactly this to happen.