feat(deploy): Jellyfin at home, published through WireGuard (ADR 0032)
The instance serves jellyfin.halkyon.eu and its Caddy proxies through a
WireGuard tunnel to a Jellyfin on the operator's own machine, which dials
out, so nothing names the home network's address and its router opens no
port. compose.jellyfin-home.yaml takes the sidecar's place, with its
site's rules unchanged (jellyfin.caddy's upstream is now a setting), and
leaves JELLYFIN_URL unset, so the instance suggests it only while it
answers.
On the instance's server the tunnel reaches Jellyfin from Caddy alone and
nothing of the host (wg-jellyfin-rules.sh, set and removed with the
tunnel); the CI runner's unit denies it, and CI's Sandbox step fails if a
job reaches it. The home end keeps Jellyfin in WireGuard's network
namespace, its port on the loopback alone. The steps are in
deploy/sidecars/README.md, the rules held by test/deploy/jellyfin_home_test.dart.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
2026-10-30 22:49:47 +01:00
|
|
|
# Jellyfin at home, published by the instance (ADR 0032): the Jellyfin sidecar's site,
|
|
|
|
|
# with Caddy proxying through a WireGuard tunnel to a Jellyfin on the operator's own
|
|
|
|
|
# machine (home-jellyfin/), rather than to one beside the instance. Nothing of the home
|
|
|
|
|
# network shows: people reach the instance's server alone. Switched on in .env, in place
|
|
|
|
|
# of compose.jellyfin.yaml, never beside it:
|
|
|
|
|
#
|
2026-11-02 22:06:18 +01:00
|
|
|
# COMPOSE_FILE=compose.learn.yaml:compose.jellyfin-home.yaml
|
feat(deploy): Jellyfin at home, published through WireGuard (ADR 0032)
The instance serves jellyfin.halkyon.eu and its Caddy proxies through a
WireGuard tunnel to a Jellyfin on the operator's own machine, which dials
out, so nothing names the home network's address and its router opens no
port. compose.jellyfin-home.yaml takes the sidecar's place, with its
site's rules unchanged (jellyfin.caddy's upstream is now a setting), and
leaves JELLYFIN_URL unset, so the instance suggests it only while it
answers.
On the instance's server the tunnel reaches Jellyfin from Caddy alone and
nothing of the host (wg-jellyfin-rules.sh, set and removed with the
tunnel); the CI runner's unit denies it, and CI's Sandbox step fails if a
job reaches it. The home end keeps Jellyfin in WireGuard's network
namespace, its port on the loopback alone. The steps are in
deploy/sidecars/README.md, the rules held by test/deploy/jellyfin_home_test.dart.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
2026-10-30 22:49:47 +01:00
|
|
|
# JELLYFIN_DOMAIN=jellyfin.halkyon.eu
|
|
|
|
|
#
|
|
|
|
|
# The tunnel is the host's (wg-quick@wg-jellyfin, with the rules letting Caddy alone
|
|
|
|
|
# through it), set up once as root: sidecars/README.md, *Jellyfin at home*.
|
|
|
|
|
|
|
|
|
|
services:
|
|
|
|
|
caddy:
|
|
|
|
|
environment:
|
|
|
|
|
JELLYFIN_DOMAIN: ${JELLYFIN_DOMAIN:?set JELLYFIN_DOMAIN in deploy/.env}
|
|
|
|
|
# The home end's address in the tunnel (D3).
|
|
|
|
|
JELLYFIN_UPSTREAM: 10.61.96.2:8096
|
|
|
|
|
volumes:
|
|
|
|
|
- ./sidecars/jellyfin.caddy:/etc/caddy/sidecars/jellyfin.caddy:ro
|
|
|
|
|
|
|
|
|
|
server:
|
|
|
|
|
# No JELLYFIN_URL (D9): the instance looks at jellyfin. on its own domain and
|
|
|
|
|
# suggests it only while it answers, as the home end is away whenever its machine
|
|
|
|
|
# is. It looks through Caddy on edge, not by the public address back in.
|
|
|
|
|
extra_hosts:
|
|
|
|
|
- ${JELLYFIN_DOMAIN:?set JELLYFIN_DOMAIN in deploy/.env}:172.30.80.2
|