If you plan to use fail2ban, I assume you want to make your Jellyfin accessible from the public internet. Please be aware, that large parts of the Jellyfin Backend are not properly authenticated and allow unauthorized, potential mapping of your library and even unauthorized streams.
post
replies:
Why? Fail2ban is best placed on the host closest to a network entrypoint. Unless you're intentionally avoiding a bridged network, this isn't going to do much for your security unless the containers are directly addressed by an attached interface and an open service.
I won't go into a whole diatribe, but you should be running containers as single-process instances of applications. You only cause issues by cramming other process to run inside a container.
What are you using it to block, exactly?
replies:
I set up fail2ban together with Caddy which runs as a reverse proxy in front of Jellyfin. I've written down my setup and maybe this will help you https://codeberg.org/skjalli/jellyfin-vps-setup
[deleted]
all 18 comments