Selfhosted

Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I've seen in this thread:

[Thread #311 for this comm, first seen 23rd May 2026, 22:30] [FAQ] [Full list] [Contact] [Source code]

afaik but I’m not sure, Jellyfin lacks support for OIDC AuthN which is a clear sign that you cannot expose this publicly.

Ask them to use the Jellyfin web, and you expose it to the public via Netbird / Pangolin locked behind SSO

Tailscale

How much access do you have to their system? I would set up a script on their end to poll https://ipv4.icanhazip.com/ and send you their IP. I would then trigger a firewall rule change on your end to that information. This keeps the access to only their IP, with maybe a few minutes between polls where it might be different.

Adding onto the other comments, if you have admin access to your network router/firewall you can configure the incoming port forward itself to only allow specific IP addresses while dropping traffic from any other internet WAN IPs. It's a bit like using the Jellyfin whitelist/blacklist but doing it at the network level. This drops all unwanted internet traffic to that port at the firewall before ever reaching the Jellyfin software. Downside is having to occasionally update the firewall whenever there are IP address changes.

This is probably only feasible if you only have some specific Jellyfin clients in mind to accept connections from, not any random person from any random WAN IP address.

Does Tailscale count as a VPN for you? It’s how I roll. Well, I run my own headscale server, but the free Tailscale tier is going to be fine for any reasonably sized personal project.

See if there are any apps that will handle the VPN tunneling transparently, then provide the web interface, all in one.

If you can't find any that work like you want, I would put an authenticating reverse proxy in front of jellyfin. But last time I tried that, it only half worked. I don't know if that's changed.

Worst case, a reverse proxy that only exposes the necessary endpoints. Or a WAF that can block known attacks.

In any case, you should have a firewall rule as narrow as possible to only limit access to them. Static IP address if possible, then subnet, then ASN. Whatever is the most restrictive but still works.

you don't.

if you're intent on "spreading your legs" to the world, get a WAF.

edit: don't get mad about the analogy, it's apt.

when you open your local network to public access without protection, you're bound to have a couple "accidents" and "infections".

protect your local network with at least a proper firewall and segmented network.

a properly configured WAF is better than any reverse proxy you could use.