Jellyfin, how to totally disable HTTP access

Hi everyone,

I have a fully functional Jellyfin container accessible via LAN or via VPN.

I need to have a friend use Jellyfin securely so I installed Swag following this guide setting up a DuckDNS domain.

I can log in but it's not clear to me if the connection is really secure, let me explain better.

On the router I have enabled port forwarding of ports 80 and 443 on the related 81 and 444 of my Jellyfin server. In Jellyfin settings I have enabled HTTPS.

The problem is that through the Jellyfin client I can add the server both via the HTTP or HTTPS address. Jellyfin standard ports 8096 and 8920 are blocked on my router and are not configured on its container (removed ports section).

How can I verify that the connection is actually secure when my friend enters his username and password?

Is it possible to completely disable HTTP access, preventing friends from connecting inadvertently by writing HTTP (instead of HTTPS) in the Jellyfin client address?

Sorry but I know next to nothing about reverse proxy, swag etc. and therefore it is not clear to me how an HTTP connection can be secure for the simple use of swag

Quote from ryecoaaron

I would never open port 80 and 81 on your router since they are http.

Port 80 is now closed on my router, only 443 to Jellyfin server port 444 is forwarded.

On Swag 80:81 port map is commented but I can set Jellyfin server on Jellyfin client using HTTP link. See screenshots

Quote from pcon

If you want to verify if only https is working from the internet connection use a Mobil device like you’re smart phone without WiFi and connection and use mobile data for the internet connection. If you can connect only with https then it is all fine.

This is what I did, Jellyfin screenshot comes from my smartphone (using mobile data connection) and I used HTTP link in the app, see this screenshot

Quote from pcon

Is there a configuration that redirects http requests to https for the Jellyfin website? This could be an explanation.

In screenshot 1.jpeg port 81:80 is disabled, in screenshot 2.jpeg port 80 is used for the swag configuration. There seems to be something wrong with the swag configuration. Normally it should only use https like 1.jpeg configuration, but 2.jpeg shows 80 and 444:443.

We need more specific information for support. Can you post your compose file of Swag and Jellyfin?

Also the file /path_to_config_swag/nginx/proxy-confs/jellyfin.subdomain.conf

I see port 80 on Swag, but as you see it is not configured.

This is Jellyfin compose file:

---
# https://hub.docker.com/r/linuxserver/jellyfin
services:
  jellyfin:
    image: lscr.io/linuxserver/jellyfin:latest
    container_name: jellyfin
    network_mode: swag-net
    environment:
      - PUID=${APPUSER_PUID}
      - PGID=${APPUSER_PGID}
      - TZ=${TIME_ZONE_VALUE}
      #- JELLYFIN_PublishedServerUrl=192.168.0.69 #optional
    volumes:
      - CHANGE_TO_COMPOSE_DATA_PATH/jellyfin/library:/config
      - CHANGE_TO_COMPOSE_DATA_PATH/jellyfin/tvseries:/data/tvshows
      - CHANGE_TO_COMPOSE_DATA_PATH/jellyfin/movies:/data/movies
      - /srv/dev-disk-by-uuid-<my_disk_uuid>/SHARED/FILM:/film
    ports:
      - 8096:8096
      - 8920:8920
    restart: unless-stopped

where <my_disk_uuid> is the uuid of my HDD, and this is Swag one:

---
# https://github.com/linuxserver/docker-swag
services:
  swag:
    image: lscr.io/linuxserver/swag:latest
    container_name: swag
    network_mode: swag-net
    cap_add:
      - NET_ADMIN
    environment:
      - PUID=${APPUSER_PUID}
      - PGID=${APPUSER_PGID}
      - TZ=${TIME_ZONE_VALUE}
      - URL=<my_domain>.duckdns.org
      - VALIDATION=http
      - SUBDOMAINS=jellyfin
      - CERTPROVIDER= #optional
      - DNSPLUGIN=cloudflare #optional
      - PROPAGATION= #optional
      - EMAIL= #optional
      - ONLY_SUBDOMAINS=true #optional
      - EXTRA_DOMAINS= #optional
      - STAGING=false #optional
    volumes:
      - CHANGE_TO_COMPOSE_DATA_PATH/swag/config:/config
    ports:
      - 444:443
      #- 81:80 #optional
    restart: unless-stopped

where <my_domain> is my Duck DNS domain.

Finally this is Swag configuration for Jellyfin:

## Version 2024/08/22
# make sure that your jellyfin container is named jellyfin
# make sure that your dns has a cname set for jellyfin
# if jellyfin is running in bridge mode and the container is named "jellyfin", the below config should work as is
# if not, replace the line "set $upstream_app jellyfin;" with "set $upstream_app <containername>;"
# or "set $upstream_app <HOSTIP>;" for host mode, HOSTIP being the IP address of jellyfin
# in jellyfin settings, under "Advanced/Networking" add subdomain.mydomain.tld as a known proxy

server {
    listen 443 ssl;
    listen [::]:443 ssl;

    server_name jellyfin.*;

    include /config/nginx/ssl.conf;

    client_max_body_size 0;

    location / {
        include /config/nginx/proxy.conf;
        include /config/nginx/resolver.conf;
        set $upstream_app jellyfin;
        set $upstream_port 8096;
        set $upstream_proto http;
        proxy_pass $upstream_proto://$upstream_app:$upstream_port;

        proxy_set_header Range $http_range;
        proxy_set_header If-Range $http_if_range;
    }

    location ~ (/jellyfin)?/socket {
        include /config/nginx/proxy.conf;
        include /config/nginx/resolver.conf;
        set $upstream_app jellyfin;
        set $upstream_port 8096;
        set $upstream_proto http;
        proxy_pass $upstream_proto://$upstream_app:$upstream_port;

    }

    # Restrict access to /metrics
    # https://jellyfin.org/docs/general/networking/monitoring/#prometheus-metrics
    location /metrics {
        allow 192.168.0.0/16;
        allow 10.0.0.0/8;
        allow 172.16.0.0/12;
        allow 127.0.0.0/8;

        deny all;

        include /config/nginx/proxy.conf;
        include /config/nginx/resolver.conf;
        set $upstream_app jellyfin;
        set $upstream_port 8096;
        set $upstream_proto http;
        proxy_pass $upstream_proto://$upstream_app:$upstream_port;
    }
}

Thanks

Many thanks for the extended explanation.

Today I’ll try to login with a fake account in order to not pass valid username and password using HTTP, I didn’t try to perform the login with my real account.

Maybe application show HTTP but internally the connection was redirected to HTTPS or maybe it doesn’t perform the login and the login screen is shown by the application itself without a real communication with the server, I’ll try!

My router is a FritzBox and by default forwarding should be locked

Quote from pcon

Have you configuration like the 2 screenshot? Have you set something like "Independent Port Sharing" or "Open this device completely for internet sharing via xxx (exposed host)". is your configuration for IP4, IP6 or both.

Here you are the requested screenshots. Redirection of port 80 was removed after first post.

Maybe some of you doesn't understand correctly the problem.

Jellyfin, Swag and my router seem correctly configured, see all screenshots/configurations from previous and current post BUT the problem is that with the iOS Jellyfin client I can login to the server using HTTP link: why?

If it is Swag that redirects to HTTPS is ok but in which way can I verify this? Some logs?

Many thanks

Quote from pcon

...or tcpdump on the server. With this tools you capture the network traffic and check if there connection are encrypted or not.

Could you please send me a command example?

Something like tcpdump tcp port 80?

Quote from pcon

You can use this tcpdump -n port 80

Tried, it seems that no traffic is present during streaming on port 80 so I was correct when I wrote this:

Quote from Ionic

If it is Swag that redirects to HTTPS is ok...

The interesting thing is that with my wife's mobile network provider I cannot access the server using the HTTP link, with my provider I can but there is no traffic on port 80/81 while there is traffic on port 444 (that was redirected from external 443).

So the browser actually shows the redirect changing the link with HTTPS, the application has this lack and it seems that the connection is made in HTTP without encryption.

Thanks for your help and for understanding the question