In my experience getting dozens of people on to my server, plenty will happily choose to pay for Netflix. I want people to choose my server over paid streaming, so I offer both Plex and Jellyfin, and to date not a single person has stuck with Jellyfin, and several have gotten my invite email, took a look at the FAQ on how to request media, and continued using paid streaming.
- Posts
- 0
- Comments
- 260
- Joined
- 3 yr. ago
- Posts
- 0
- Comments
- 260
- Joined
- 3 yr. ago
Not really haha, you could say I followed a tutorial for setting up a wireguard server on a VPS, and then once I had the wireguard container running and my homelab boxes as clients, I started up an haproxy container on the VPS with
network_mode: "service:wireguard"so that the haproxy container can also see my homelab boxes through the tunnel, then also added ports 80 and 443 to the wireguard container on the VPS (in addition to the 51820 for incoming wireguard connections) - that has to be on the wireguard container because using network_mode means the haproxy container piggy backs on the wireguard container's network, then I added a simple haproxy config that listens on 80/443 on the VPSes public IP and proxies it to the appropriate box on the other side of the tunnel.For the wireguard config, the key seems to be using
mode tcpin any backend or frontend that's connected to port 443, so that it just proxies raw data without doing termination. With SNI, you can even proxy to different wireguard clients based on domain, because SNI exposes the domain without needing to do termination. So I do that because I have my NAS as well as a NUC connected to the wireguard network hosting different things.This is a stripped down version of my haproxy config:
global maxconn 20000 log 127.0.0.1 local0 daemon defaults mode http timeout connect 10s timeout client 1m timeout server 1m maxconn 8000 option tcpka option tcp-smart-connect default-server init-addr last,libc,none resolvers docker parse-resolv-conf frontend ingress_http bind :::80 bind :80 acl h_secondbox_http hdr(host) -i second.box.example.com use_backend secondbox_http if h_secondbox_http default_backend vault_http frontend ingress_https mode tcp bind :::443 bind :443 tcp-request inspect-delay 5s tcp-request content accept if { req_ssl_hello_type 1 } acl h_secondbox_https req_ssl_sni -i second.box.example.com use_backend secondbox_https if h_secondbox_https default_backend vault_https backend vault_http server vault_server_http 10.13.13.2:80 send-proxy-v2 backend vault_https mode tcp server vault_server_https 10.13.13.2:443 send-proxy-v2 backend secondbox_http server secondbox_server_http 10.13.13.3:80 send-proxy-v2 backend secondbox_https mode tcp server secondbox_server_https 10.13.13.3:443 send-proxy-v2The way this is set up, I do have to manually enter every subdomain I want to go to my second box, but the default is to route to my main vault, which is where I host most stuff anyways.
My docker compose on the VPS is pretty simple:
services: wireguard: image: linuxserver/wireguard:latest container_name: wireguard restart: unless-stopped cap_add: - NET_ADMIN - SYS_MODULE environment: - PUID=0 - PGID=0 - TZ=America/New_York - SERVERURL=wg.example.com #optional - SERVERPORT=51820 #optional - PEERS=vault,secondbox #optional - PEERDNS=auto #optional - INTERNAL_SUBNET=10.13.13.0 #optional - ALLOWEDIPS=10.13.13.1/24 #optional - PERSISTENTKEEPALIVE_PEERS=all #optional - LOG_CONFS=true #optional volumes: - ./volumes/wg-config:/config ports: - 51820:51820/udp - 80:80/tcp - 443:443/tcp - 8090:8090/tcp sysctls: - net.ipv4.conf.all.src_valid_mark=1 haproxy: image: haproxy:lts container_name: haproxy restart: unless-stopped network_mode: "service:wireguard" depends_on: - wireguard volumes: - ./volumes/haproxy-config:/usr/local/etc/haproxyThen on the local side I use the same
network_mode: "service:wireguard"trick to link my traefik container to the wireguard container, that way traffic hitting ports 80/443 of the wireguard container which is on the tunnel is also seen by traefik:services: boringtun: image: boringtun build: ./boringtun-docker container_name: boringtun restart: always privileged: true cap_add: - NET_ADMIN devices: - "/dev/net/tun:/dev/net/tun" volumes: - "./volumes/wg-config/wg0.conf:/etc/wireguard/wg0.conf" logging: driver: "json-file" options: max-size: "400k" max-file: "20" environment: - INTERFACE_NAME=wg0 - WG_SUDO=1 - WG_QUICK_USERSPACE_IMPLEMENTATION=/app/boringtun entrypoint: /bin/bash command: -c "wg-quick up wg0 && sleep infinity" extra_hosts: # Allows containers to access the host machine as host.docker.internal, useful for remote access to the host through a container - "host.docker.internal:host-gateway" networks: - ingress traefik: image: traefik:v2.11 container_name: traefik restart: always network_mode: "service:boringtun" depends_on: - boringtun command: # - "--log.level=DEBUG" - "--providers.docker" - "--entrypoints.web.address=:80" - "--entryPoints.web.proxyProtocol.trustedIPs=10.13.13.1" - "--entrypoints.websecure.address=:443" - "--entryPoints.websecure.proxyProtocol.trustedIPs=10.13.13.1" - "--entrypoints.web.http.redirections.entrypoint.to=websecure" - "--entrypoints.web.http.redirections.entrypoint.scheme=https" - "--entrypoints.web.http.redirections.entrypoint.priority=100" # Timeouts - "--entryPoints.websecure.transport.respondingTimeouts.readTimeout=0" - "--entryPoints.websecure.transport.respondingTimeouts.writeTimeout=0" - "--entryPoints.websecure.transport.respondingTimeouts.idleTimeout=0" - "--providers.docker.exposedByDefault=false" - "--providers.docker.network=ingress" - "--certificatesresolvers.mytlschallenge.acme.tlschallenge=true" - "--certificatesresolvers.mytlschallenge.acme.email=youremail@example.com" - "--certificatesresolvers.mytlschallenge.acme.storage=/letsencrypt/acme.json" - "--serversTransport.forwardingTimeouts.dialTimeout=3m" # - "--api.insecure=true" # - "--certificatesresolvers.mytlschallenge.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory" environment: - TZ=America/New_York volumes: - ./volumes/le-data/acme.json:/letsencrypt/acme.json - /var/run/docker.sock:/var/run/docker.sockI only use boringtun on this side because I think synology doesn't or didn't have the kernel module for wireguard and using the userspace mode made it work for me, otherwise you could probably just use the regular wireguard container. Also note that my docker network for communicating between traefik and stuff I'm exposing is
ingress, which is specified both on the boringtun container as well as passed to traefik asproviders.docker.network, I think that's needed so that traefik can figure out the container IP of the containers you're exposing. I also haven't migrated to traefik v3 because I'm lazy.Another note, there's an annoying condition where if you reboot, it may fail to attach the traefik container to wireguard because it linked via network mode to the old container. Just doing compose down and up fixes it by recreating all the containers. But other than that which I haven't encountered in a while it works really well. I'm not sure if that bug was fixed because I rarely reboot.
I mostly just use the Synology files app or samba over wireguard, and then sync a couple tb of super critical stuff to rsync.net. I have next cloud set up but all I use it for is editing my cook book from multiple devices and storing the few documents I migrated off of gdrive, but I might as well just have them in a regular folder on my nas instead.
Do most people running a vps reverse proxy terminate tls on the vps? I just proxy TCP 1:1 without touching it to my homelab over my wireguard tunnel. That seems easier than coordinating between the vps which services I'm running locally.
I also would want to pick the quality/size of the file depending on the show (good shows deserve better quality).
I do this too and that was a major hesitation in switching to use arrstack. What I do is each library (movies, TV) has an organized folder (Archive) and a folder for arrstack (Active). I have both added to arrstack and Plex/jellyfin but I only let it download automatically to the arr folder. Every week or two I check what people have requested and downloaded into the arr folder and either move it to the archive since I'm happy with the quality / release group, or I use arr's ui to pick a different release with a single click.
It's nice because I get the best of both worlds, hands free downloading for 10-15 people, new episodes daily, but I also get to screen and control what goes into my archive and upgrade important shows before I lose track of it.
What defaults are you talking about? If you meant to reply to my other comment, I'm talking about hardware transcoding codec support settings on the server, it has nothing to do with what codec is chosen for a client - that decision is made separately. Once the codec the client needs is chosen, the hardware transcoding setting only changes whether they codec is decoded using CPU or GPU/quicksync by the server - it has no effect on codec selection. The only reason you would disable hardware transcoding for a codec that your server is capable of hardware transcoding is if your hardware is faulty or produces undesirable output for that codec when using hardware transcoding - most people don't do this, it's a fairly uncommon edge case. And disabling it won't stop clients from accessing that codec, it just means that your server will CPU transcode it if requested instead of using hardware acceleration - so again it has nothing to do with client support or TVs because all it does is switch your server between hardware and software encoding / decoding. The only sane default for that setting is to hardware accelerate codecs that your PC is capable of hardware accelerating if hardware acceleration is enabled. There's no reason not to automatically detect hardware capabilities like Plex does, instead of the current "default" where you enable hardware transcoding and then have to figure out what your hardware supports to be hardware accelerated.
Like even if they copy pasted the quicksync codec support table from Wikipedia into the server hardware acceleration settings that would be miles better because then you wouldn't have to look up that information separately. Or, hear me out, just show next to each option which ones your computer is capable of hardware decoding vs CPU decoding.
It's not, and I didn't say it was hard. Just that it's a sharp corner that jellyfin should fix if they want to make it as one click as Plex is. It's another part of the setup where you have to pay attention and get every check box right or it'll not work as intended. I found it annoying to have to look it up and I've been in software for 15 years. I don't doubt that any newb would find it frustrating. I remember seeing that it was planned to have hardware transcoding codec support auto detected but IDK if that has happened yet.
It's especially annoying because jellyfin doesn't just copy the support matrix into their docs, and the one on Wikipedia is by processor generation codename, so you have to look up your processor and get the codename, then reference the Wikipedia table and go down each codec and not make a mistake. Even though it's "not hard" I still go back to that section because I second guess that I checked everything right thinking that I've caused some issues with a mistake. It's additional cognitive load that isn't worth defending if you want jellyfin to be good.
Yep, and it generally has fewer sharp corners. Like last time I checked, in order to set up quick sync, you have to manually check each codec you want to offload to hardware. And if you select one that isn't supported by your hardware, you find out when you try to play that. So it means carefully cross-referencing with the Wikipedia page for your quick sync version. Plex just has an enable hardware transcoding check box and it figures it out for you.
There's also some features like smart playlists that I remember needing to set up plugins for whereas Plex supports it out of the box.
Of course ther are other things where jellyfin comes out ahead, like surround to stereo down mixing - I could never get the center channel (dialog) to be at a good volume when down mixed to stereo on my TV, but it just works and produces the correct volume in jellyfin.
But ultimately I think what causes all my users to prefer Plex is that the official app is polished and consistent across all platforms. The official jellyfin one looks like a programmer put it together with bootstrap components, and my favorite alternatives (like findroid) are in active development (I do donate on a reoccurring basis though in hopes that it reaches a level of polish matching Plex)
Hopefully that gets better - I run both side by side pointed at the same folders so the exact same media is available in both. I offer all my friends the choice and list every alternate app I know of, inevitably they all prefer Plex.
Purging into the chute doesn't leave the nozzle with the same pressure as priming onto a surface because there's no resistance. So even if you retract the same after both, you'll get a different line start. Priming onto a surface is the best way to guarantee that the next line start is identical to one that comes after a print move and not differently due to coming from the poop chute.
Mrrow :3
A big issue though is that you can't move other people's projects for them. If I want to contribute to Immich, I have to be on GitHub. Cloning it somewhere the maintainers aren't looking or accepting contributions does nothing.
I mean I'm not really concerned about it being actually private, I just need to not have asset creators become pissed at me for publicly hosting their paid assets. Self hosting forgejo is on my to-do list but until then I'm using GitHub as a free project host for my unity/blender projects with paid assets. A single one of those projects easily blows past the codeberg 100MB private repo limit.
Besides that, basically the only use I have for GitHub is to contribute to repos on GitHub or to open / comment on issues. So it feels kind of useless to use codeberg since it defeats the whole purpose when the repos I want to interact with aren't there.
Self hosting also means I wouldn't be able to accept PRs, comments, or issues from other people unless I let them create accounts, which is something I don't want to moderate. I was waiting for forgejo to get federation to self host it but I haven't seen an update from them about that in a while.
So basically there are 2 things I use GitHub for:
- Keeping private projects safe, which are too big for codeberg to allow
- Opening issues on repos that are on GitHub, so using codeberg completely defeats the purpose
Codeberg is like a GitHub where the projects I want to interact with don't exist, and copying the projects there doesn't help me give feedback to the original authors.
It's for private repos only, so if you cloned public repos that wouldn't count towards the limit.
And it sounds like it's total for your whole account, you can read about it here:
https://codeberg.org/Codeberg-e.V./requests
Storing private repositories is allowed for things related to Free Software, or small content like personal notes. It is limited to 100 MiB per user.
And: https://docs.codeberg.org/getting-started/faq/#how-about-private-repositories?
Codeberg's mission is to promote free/libre software. Keeping software private is obviously not our primary use case, but we acknowledge that private repositories are useful or necessary at times.
- If you are a contributor to free/libre software projects, we allow up to 100 MB of private content for your convenience. Use it for your personal notes, your side project or any other you want to keep private.
So yeah, my unity projects with paid assets are ostensibly "side projects", but 100MB is less than the size of the unity project file or blender assets. So if I can't use codeberg to keep my unity projects, and I can't use it to contribute to projects that live on GitHub (like Immich), or to host forks of projects for the original authors to see where the original repo and author is on GitHub, I basically can only use it to mirror projects that I want to "put out into the world" with no specific audience in mind. And for that purpose, so few people ever actually come across my projects that I feel like I might as well just email them to myself.
The biggest use case for using GitHub for me is to interact with people and projects that are on GitHub.
One thing that keeps me from using codeberg more is that private repos are limited to 100MB. So I still need to use GitHub to keep some of my personal projects that contain purchased assets that can't be made public. I do still have a codeberg account and mirror what I can, but it means I can't stop using GitHub for now.
"Don't apply if you hate AI"
Sigh
Non-technical teams are now shipping production code
Hmmmmmm...
Damn, about $70 + shipping at jlcpcb with assembly (minus a couple additional components I didn't bother to match). Probably $100 for 5 boards. My laser sessions are $300 and it takes a bunch. I'm really tempted to order this.
I have a very similar experience, I still use Spotify and YT to discover new music, but I then torrent it (or find it on soulseek) to keep my jellyfin collection growing. I also buy off bandcamp since that's pretty convenient to fill in my favorite albums.
Doesn't it affect all of us in that we cannot safely run it exposed to the internet? I mean I still yolo it and run my jellyfin completely exposed because there's no way I'm guiding anyone through setting up wire guard or configuring clients to do additional auth, but still. I would love to not worry about that.