After trying out Cosmos Cloud (and it not working for the clients), I’m back at square one again. I was going to install Docker Desktop, but I see it warns that it runs on a VM. Will this be a problem when trying to remote connect to certain services, like Mealie or Jellyfin?
To your first questions, well need to untangle a few thoughts wrapped into that.
Right now, http://your-server-ip:8096/ is plain HTTP. On your home network that’s usually fine. Over the internet, you’d want HTTPS so passwords and stream data aren’t sent in the clear.
Just opening a port on Docker only exposes it to your local network. It’s not on the public internet unless you also forward the port on your router. So by default, only devices on your network can reach it.
From there is it secure? That’s on Jellyfin. Using strong passwords and trusting Jellyfin is secure is as good as you can do here.
The reverse proxy is where you handle the https, and where you go from domain.com:8096 to jelly.domain.com
If using caddy for example, that looks like this somewhere in your caddyfile
Your reverse proxy sits in front of your containers and routes traffic by hostname. You tell it: “when someone visits jellyfin.yourdomain.com, send them to the Jellyfin container on port 8096.”
The other pieces you’ll need:
DNS pointing jellyfin.yourdomain.com at your server’s IP (public IP if accessing from outside, local IP if just at home) A TLS certificate so HTTPS works, Let’s Encrypt is free, and Caddy gets them automatically with zero config (Nginx and Traefik can too, just more setup).
Also rputer port forwarding on 80 and 443 to make it accessible outside the house.
The last part there is the actual risky part. When you put a service on the open internet, bots from everywhere will find it instantly and begin running scripts to try to find a way in. With only this setup, again, the insecurity is Jellyfin. When an exploit drops, you need to be updated ASAP to stay on top of your security.
There are tons of ways to make this more secure. The easiest way would be tailscale/(wireguard). You basically install tailscale on every device that will connect to your server instead of opening your routers port. It keeps your device off the open internet but allows devices all on its tailscale VPN connect to it with the domain you setup.
You can achieve something similar using cloudflare tunnels. Your server runs a daemon that reaches out to cloudflare and it’s served to the internet that way, friends access via normal URL, no extra download required.
Lastly the best but cost prohibitive option is to do it through a VPS. A virtual private server does what cloudflare does, basically, but you control it. If the money is not prohibitive, I strongly recommend this. When cloudflare goes down again (and it will go down again), you won’t be beholden to their infrastructure being online to access your server.
Happy to clarify anything here. I wrote this response in 3 parts and rereading it it feels a little disjointed lol