This is an automated archive made by the Lemmit Bot.
The original was posted on /r/selfhosted by /u/Urittaja023984 on 2025-12-01 09:02:29+00:00.
So I've been running variations of my own stack for a long time, but have always avoided the great and terrible public Internet. This has meant local network only, Wireguard, getting frustrated with telling people how to Wireguard and switching to Tailscale so people can just "install app and connect" and so forth. My current setup is a home server (some old piece of office computing with a server motherboard I picked for cheap used) fitted with a 2TB SSD with Proxmox, where I host most of my services like a true pagan in a single VM via a single file of docker compose spaghetti just allocating 90% of the disk for the single VM.
This weekend, after yet another manual configuration session of doom with Nginx proxy manager, Pi-hole local DNS and Tailscale, I figured I'm tired of the GUI. Everything else in my stack is infrastructure as code (IAC), so why not the rest of it too. I'm also tired of logging into every service one by one, so just knock SSO at the same time, because why not (spoilers: it was not simple, should have guessed).
What resulted was half of my weekend spent configuring, tinkering, hitting my LLM usage maxes and a lot of RTFM moments, but in the end I can now happily report that the whole stack is now accessible from internet and behind some sweet, sweet SSO.
After a few tests I ended up going with Cloudflare (DNS + Tunnels) + Traefik + Authelia. I split my services into two groups: User facing software I want to be accessible from Internet directly and admin stuff only via Authelia. I figured because Jellyfin+Jellyseer work so nicely together, my users already have and know their credentials there and nobody except me really requires the SSO stuff for the underlying stack, I'll just keep those using their own auth and move myself alone to the SSO (and just use my own Jellyfin account like my users).
In the end the result was:
Internet
|
Cloudflare DNS + Tunnel
|
/\
Authelia Media (Jellyfin, Jellyseer, Wizarr)
|
|
Admin (Dashy, Glances, *arrs)
This way my users get invite via Wizarr explaining everything (+ I get easy visibility and user management) and can connect to the Jellyfin / Jellyseer with just my domain, no tricks required. Users use the basic Jellyfin account and auth for both Jellyfin and Jellyseer.
Authelia sits in front of all the admin stuff, making it easy for me to just handle the login there. For now I'm the only admin, so I figured to just use a local user in Authelia to login.
Surprising amount of time was spent on:
- Figuring out to make Cloudflare tunnel HTTP and use traefik for HTTPS/SSL termination
- Traefik-Authelia and required middleware
- Making sure Cloudflare tunnel is not using caching for the Jellyfin. My understanding is that this is enough for the ToS, but would appreciate if anyone knows definitively.
Anyways I wish I kept a better install journal, as there was a bazillion things I fixed on the way here, as the stack had been running for a while without intervention. I also set up UptimeRobot with integration to my Discord to ping me in case the media services aren't working.
Only thing left unsatisfactory in the stack was the Cloudflared docker container setup:
The Cloudflare panel GUI was even worse than nginx proxy manager, but fortunately they have API-access. Unfortunately I didn't get the Cloudflared docker container to be able to create the required tunnels itself and had to resort to a bash script that does it via the API. It works, but it's still half manual as it doesn't handle migrations and deletes, only does updates and requires update in the script in case my paths change. That's hopefully rare enough that it doesn't matter too much.
I think I spent over 8 hours on this during the weekend (other obligations, so in hour-two increments) and overall happy. Huge increase in requests, bots and crawling, my domain used to get 100 hits a month and now it's thousands per day, but that's ofc also because the applications themselves are much request heavier than what I used to host (only a static homesite that didn't get much traffic).
What surprised me was the lack of comprehensive guides for this. I'm still not sure if my stack is what you'd call "optimal", but at least it works for me and my users right now :)
