If both your Jellyfin server and your siblings are behind residential CGNAT, then high chance your connections are relayed through Tailscale's DERP servers. You can check with tailscale ping-ing your sibilings' nodes.
If this is the case, you may consider selfhosting your own DERP somewhere close to you, but I'd argue the performance gains are minimal compared to the extra costs. Another solution would be to enable IPv6 for both you and your siblings, skipping NAT traversal. I just hope both ISPs support it and support it properly in $CURRENT_YEAR.
This is all assuming you can direct play (i.e. not transcoding) your media. If you're transcoding, then it's good to look into hardware acceleration like the other comment mentioned, too
Is there a way for a Wireguard peer to advertise AllowedIPs similar to Tailscale's subnet routings? If that's right, perhaps you can configure your host's address as one of the AllowedIPs on the OpenWRT peer, and skip port forwarding too
My concern would be the need to set up some non-Tailnet mechanism to expose it to the internet and keep it secure. Either port forwarding, Pangolin, or even using Funnel... all of which would be better off on a separate device (and maybe a separate VLAN)
It'd be an interesting idea for sure, perhaps for when I can get myself the separate Headscale-dedicated device. Although now I'd have to learn the "normal" zone-based networking ahah
DNS adjustments aren't needed if you do .well-known delegations which is easier
Can recommend continuwuity, it runs much better on less resources. Lacks certain features compared to Synapse but overall good
Notifications (and read markers) depend on client-specific black magic to work
Federation do sometimes silent-fail completely, you can reset continuwuity's cache + restart when that happens. But full room history convergence needs patience
Don't join large rooms unless your server can handle the load
Don't host public rooms without modbots
The many small bugs make Matrix still bad - I wouldn't recommend a non-tech user unless accompanied by a 24/7 admin. It is trying to improve but very slow because of reasons
If you can selfhost and can use containers/docker, I wanna shamelessly plugin my solution: https://github.com/stratself/tswg. Basically mount a WireGuard config from Nord or any upstream VPN, and the container will tunnel traffic to said VPN when you choose it as an exit node.
There are other gluetun + tailscale solutions that are worth a look too
Let's Encrypt are rolling out IP-based certs, you may wanna follow its development. I'm not sure if it could be used for your forwarded VPN port, but it'd be nice anyhow
Edit: I believe encryption helps prevent tampering the data between the server and user too. It should prevent for example, someone MITM the connection and injecting malicious content that tells the user to download malware
I agree that the file sync is good. They (and owncloud afaik) are the only ones supporting virtual files on windows where you only download files when needed, saving storage space.
I suppose these fancy file features (bidirectional syncing, advanced conflict resolution etc) are targeted to the enterprise, not home users. So it's natural they'd include it with a bunch of bells and whistles that are half as good
Owncloud had a rewrite called oCIS (Owncloud Infinite Scale). Then it was bought by Kiteworks. Then many of the core devs switched to a new product/company called Opencloud. There's been quite some history over the past few years
Hey, glad you got it working. I'm late to the party, but I got a similar solution here: https://github.com/stratself/tswg. Basically just mounts your own wg.conf to the container and get Tailscale connected over it
If both your Jellyfin server and your siblings are behind residential CGNAT, then high chance your connections are relayed through Tailscale's DERP servers. You can check with
tailscale ping-ing your sibilings' nodes.If this is the case, you may consider selfhosting your own DERP somewhere close to you, but I'd argue the performance gains are minimal compared to the extra costs. Another solution would be to enable IPv6 for both you and your siblings, skipping NAT traversal. I just hope both ISPs support it and support it properly in $CURRENT_YEAR.
This is all assuming you can direct play (i.e. not transcoding) your media. If you're transcoding, then it's good to look into hardware acceleration like the other comment mentioned, too