taken from plebbit
--------------
FULL DISCLAIMER: I am by no means a networking expert, and I spent a lot of time trying to get this working for myself and have seen other people requesting this. To anyone else that's more of an expert on this or mods, if there is anything that's wrong or not right, please post below.
So you have Plex/Emby/Jellyfin or another service running on your Windows computer/server and want to get a reverse proxy running? You’ve come to the right place. I’ll break down what you need to do to get this working. For this guide, I’ll be using Caddy Server.
1. Port Forwarding
1.1
First, you will want to make sure you have ports 80 and 443 pointed your computer/server internal IP. It will most likely look something like 192.168.1.123. If you don’t know how to port forward, I would suggest googling “Port forward on brand router” and replace brand with whatever router your using. There are too many different interfaces for me to breakdown in this guide, so you’ll be on your own for this. Whichever the case though, you do NOT want to port forward the service's port(eg: 8096).
1.2
While were at it, for Emby/Jellyfin, you’ll want to go to your servers dashboard and click Network. From here, scroll down to “Secure connection mode” and select handled by reverse proxy in the drop-down. Save and restart the service. [edit] I don't think Jellyfin has this
1.3
One thing to mention is that you might have to make sure ports 80 and 443 are also allowed through your firewall. You may or may not need to do this depending on your OS, but it probably wouldn't hurt to do it anyways. You can start by opening start and typing Firewall, and selecting Windows Defender Firewall. From here, you want to click Advanced Settings on the left side, and this should bring up a new window called Windows Defender Firewall with Advanced Security. Now click on Inbound Rules, then on the right side you want to click New Rule. Make sure the Port radial button is selected and click Next, TCP should be checked by default, same as Specific local ports. Type in 80, 443 and click Next. On this screen, for my rule, I selected Allow the connection and hit Next. This screen you can choose which network profiles you want this to apply to, I selected all of them even though its Private. Name your profile whatever you may choose and click Finish.
2. DNS
So now that we got the proper ports forwarded, we’ll want to get a DNS redirect setup. For this guide, I’ll be using NoIP.com as the example. Others suggest DuckDNS, but I’m too lazy to create an account for them. The process is probably very close though.
2.1
Create an account at noip.com. Once logged in, click Dynamic DNS on the left menu. Underneath the 0 of 3, click “Add a Hostname”. At this screen, you can choose your hostname and domain, you want the record type as “DNS Host (A)” which is default, for the “IPv4 Address” it should auto generate your current IP. You can double check this by going to Google or DuckDuckGo and searching what is my ip. If its correct, go ahead and create hostname. Remember the hostname you created, it should be something like “example.ddns.net”.
The above ONLY works if you have a static IP. If you have a dynamic(changing) IP, you’ll need download their “Dynamic Update Client”. Again, you are on your own for getting this to work because I haven’t had a need to use it. I would assume you just login to your NoIP account.
3. Caddy Server v2
3.1
Now, you’ll want to download Caddy Server. This guide is written for Caddy v2.
3.2
You should now have a zip file downloaded. Create a folder on your root C drive called Caddy and extract the files/documents from the zip to the folder you just created. Open the Caddy folder and create another folder called logs.
3.3 Caddy File
Now what you’ll want to do is create a caddy file, which is the caddy config file. Open the Caddy folder and create a new text file. Rename it it Caddyfile and be sure it doesn’t have an extension. If you can double click it and it opens in Notepad, it still has an extension.
For eases sake, I have 2 versions you can Copy/Paste from.
• Media Server only
• Media and other services
For this guide, I will use the Media server only example. Copy the text into your Caddyfile. Now remember your hostname that you created earlier? Copy the hostname and replace emby.xxx.org with it. Now assuming you haven’t changed default Emby/Jellyfin ports AND these servers are on the device that is running caddy, you can leave localhost:8096. If you have changed your ports or the service is running on another machine, replace localhost with the internal IP of the machine and/or replace 8096 with which ever port your service is running on. Save the file and close it.
3.3.1 Caddy File Email (optional)
Adding your email to the config file Mainly used when creating an ACME account with your CA, and is highly recommended in case there are problems with your certificates. (Source) The below snippet MUST be the first 3 lines of your Caddyfile config, and you must manually add it to your config file.
{
email you@example.com
}
Note: An issue was brought to my attention stating that this email needs to be the same as the one you registered on NoIP with. However, I did not have this issue in v1 Caddy as I used 2 separate emails for my NoIP account and the Let's Encrypt email. This may be a v2 thing I was not aware of, but I wanted to add it just in case it was happening to someone else.
3.4 Logs
If you are using my examples, they are coded to write logs, just like my v1 guide was. Make sure to change the name in the file name to whatever service you are wanting to use. Reasoning behind this step is to self audit who connects to your server.
4. Starting Caddy
Now we should have the reverse proxy setup, we’ll go ahead and start up the new version of Caddy. Caddy v2 changed the way it starts up, so we have to create a bat file to start it up. Create a new text file called Start Caddy in the Caddy folder, and open it up. In this file you simply want to paste the following:
caddy.exe run
Once done, save the file and close. Now rename the file to caddy_startup.bat. With v2, if something has an issue with the config, it will tell you what the issue is, but you’ll still have to figure out how to fix it. If its setup correctly AND/OR you are upgrading from v1 Caddy, it will reacquire new certificates. You’ll know the reverse proxy is set up properly once you see the message
2020/05/05 02:19:54.617 #[34mINFO#[0m serving initial configuration
Once you successfully run caddy and it has a good time with your config file, Caddy will ask you to enter your email address. You can enter a real one or a fake one, but this is for your Lets Encrypt certificate. I chose to enter a real email address. Note: I didn’t have to do this when I upgraded to Caddy v2, but I felt this was appropriate to keep in the v2 guide
5. Testing
You can test this by using your cellphone that is connected to your carriers internet and not your WiFi(dO yOu GuYs NoT hAvE pHoNeS?) and navigating to the hostname you created earlier.
Once you have this all successfully done this and Caddy is full functional, you will have to re-add the server on media app. When you re-add the server, use the hostname you entered earlier, but it HAS to be entered as HTTP : //example . ddns . net (remove spaces) and delete the port number. Take note on the HTTP. I’ve also encountered that in some instances if a port is required, you can enter port 443.
Now that you have all that setup, go ahead and experiment with other services if you have them running, but you wouldn’t dare use sonarr or other similar services to acquire linux iso’s right?
6. Start Caddy as service (optional)
This will create a service that will automatically start and run in the background when your machine starts up, so you shouldn't have to manually touch this again unless something changes.
6.1
Download NSSM
Extract "nssm.exe" from the "win64" folder into a folder named "NSSM" (I extracted mine to C:\NSSM) Open up command prompt as administrator and navigate to the NSSM folder directory. eg:
cd c:\NSSM
Enter
nssm install Caddy
A box should pop up. Set the path to your "Start Caddy.bat" file. Go to the Log on tab and log on with a username and password (Use the Administrator account. Click the "Install service" button.
Back in your command prompt window type
nssm start Caddy
The service should start and shouldn't have to manually touch this again unless something changes.
7. Closing
If you have any questions, drop a line below and I’ll do my best to help.
REMINDER: I am not a networking expert and this is what worked for me.
8. Resources
Caddy v1 guide. You might be able to find some helpful information in comments.
/u/DesertCookie_
points out that this guide is written for IPv4. For places with IPv6, I’m sorry I don’t have any information on how to get it working. I do know he successfully got his reverse proxy working using a CloudFlare certificate and caddy and that I asked him if he wouldn’t mind writing up the process for that. Follow his guide on the old v1 guide, but you are on your own for troubleshooting unless he updates it
/u/tonofun
tonofun's guide that they created since this helped me a lot to.
9. Edits
05/05/20 - Fixed some spelling and grammatical errors, cause I done goofed.
05/05/20@1400 - Added section 6.
05/07/20 - Removed Email section from the pastebins and added an additional section (3.3.1) that is optional.
-----------
i have a few additional comments..
yougetsignal's port forward checking tool works really well. use port 8096 in the box. if it's open, groovy. if it's closed, you'll have to go into your modem's (not router) admin page and forward the port. if you use xfinity/comcast, the modem admin panel wants you to use their shitty app.
to get to port forwarding within the xfinity app:
WiFi -> View WiFi equipment -> Advanced settings -> Port Forwarding
you should see your router name, click [edit]
scroll down the bottom and you should see "Add Port Number"
click that, use 8096 as the port and TCP/UDP as the protocol, hit apply and you should be good to go
additionally, if you don't run Caddy or Jellyfin as services and you use windows, stick a shortcut in the startup folder.
WINDOWS KEY + R -> shell:startup
TrayIt! 4.6.5.5 (majorgeeks | madassnews) can automatically minimize a program - or group of programs - to the Systray (near the clock) when it is minimized to the taskbar.
caddy_startup.bat
DUC
jellyfin
will all start from the startup folder and automatically minimize. out of sight, out of mind
--------------
FULL DISCLAIMER: I am by no means a networking expert, and I spent a lot of time trying to get this working for myself and have seen other people requesting this. To anyone else that's more of an expert on this or mods, if there is anything that's wrong or not right, please post below.
So you have Plex/Emby/Jellyfin or another service running on your Windows computer/server and want to get a reverse proxy running? You’ve come to the right place. I’ll break down what you need to do to get this working. For this guide, I’ll be using Caddy Server.
1. Port Forwarding
1.1
First, you will want to make sure you have ports 80 and 443 pointed your computer/server internal IP. It will most likely look something like 192.168.1.123. If you don’t know how to port forward, I would suggest googling “Port forward on brand router” and replace brand with whatever router your using. There are too many different interfaces for me to breakdown in this guide, so you’ll be on your own for this. Whichever the case though, you do NOT want to port forward the service's port(eg: 8096).
1.2
While were at it, for Emby/Jellyfin, you’ll want to go to your servers dashboard and click Network. From here, scroll down to “Secure connection mode” and select handled by reverse proxy in the drop-down. Save and restart the service. [edit] I don't think Jellyfin has this
1.3
One thing to mention is that you might have to make sure ports 80 and 443 are also allowed through your firewall. You may or may not need to do this depending on your OS, but it probably wouldn't hurt to do it anyways. You can start by opening start and typing Firewall, and selecting Windows Defender Firewall. From here, you want to click Advanced Settings on the left side, and this should bring up a new window called Windows Defender Firewall with Advanced Security. Now click on Inbound Rules, then on the right side you want to click New Rule. Make sure the Port radial button is selected and click Next, TCP should be checked by default, same as Specific local ports. Type in 80, 443 and click Next. On this screen, for my rule, I selected Allow the connection and hit Next. This screen you can choose which network profiles you want this to apply to, I selected all of them even though its Private. Name your profile whatever you may choose and click Finish.
2. DNS
So now that we got the proper ports forwarded, we’ll want to get a DNS redirect setup. For this guide, I’ll be using NoIP.com as the example. Others suggest DuckDNS, but I’m too lazy to create an account for them. The process is probably very close though.
2.1
Create an account at noip.com. Once logged in, click Dynamic DNS on the left menu. Underneath the 0 of 3, click “Add a Hostname”. At this screen, you can choose your hostname and domain, you want the record type as “DNS Host (A)” which is default, for the “IPv4 Address” it should auto generate your current IP. You can double check this by going to Google or DuckDuckGo and searching what is my ip. If its correct, go ahead and create hostname. Remember the hostname you created, it should be something like “example.ddns.net”.
The above ONLY works if you have a static IP. If you have a dynamic(changing) IP, you’ll need download their “Dynamic Update Client”. Again, you are on your own for getting this to work because I haven’t had a need to use it. I would assume you just login to your NoIP account.
3. Caddy Server v2
3.1
Now, you’ll want to download Caddy Server. This guide is written for Caddy v2.
3.2
You should now have a zip file downloaded. Create a folder on your root C drive called Caddy and extract the files/documents from the zip to the folder you just created. Open the Caddy folder and create another folder called logs.
3.3 Caddy File
Now what you’ll want to do is create a caddy file, which is the caddy config file. Open the Caddy folder and create a new text file. Rename it it Caddyfile and be sure it doesn’t have an extension. If you can double click it and it opens in Notepad, it still has an extension.
For eases sake, I have 2 versions you can Copy/Paste from.
• Media Server only
• Media and other services
For this guide, I will use the Media server only example. Copy the text into your Caddyfile. Now remember your hostname that you created earlier? Copy the hostname and replace emby.xxx.org with it. Now assuming you haven’t changed default Emby/Jellyfin ports AND these servers are on the device that is running caddy, you can leave localhost:8096. If you have changed your ports or the service is running on another machine, replace localhost with the internal IP of the machine and/or replace 8096 with which ever port your service is running on. Save the file and close it.
3.3.1 Caddy File Email (optional)
Adding your email to the config file Mainly used when creating an ACME account with your CA, and is highly recommended in case there are problems with your certificates. (Source) The below snippet MUST be the first 3 lines of your Caddyfile config, and you must manually add it to your config file.
{
email you@example.com
}
Note: An issue was brought to my attention stating that this email needs to be the same as the one you registered on NoIP with. However, I did not have this issue in v1 Caddy as I used 2 separate emails for my NoIP account and the Let's Encrypt email. This may be a v2 thing I was not aware of, but I wanted to add it just in case it was happening to someone else.
3.4 Logs
If you are using my examples, they are coded to write logs, just like my v1 guide was. Make sure to change the name in the file name to whatever service you are wanting to use. Reasoning behind this step is to self audit who connects to your server.
4. Starting Caddy
Now we should have the reverse proxy setup, we’ll go ahead and start up the new version of Caddy. Caddy v2 changed the way it starts up, so we have to create a bat file to start it up. Create a new text file called Start Caddy in the Caddy folder, and open it up. In this file you simply want to paste the following:
caddy.exe run
Once done, save the file and close. Now rename the file to caddy_startup.bat. With v2, if something has an issue with the config, it will tell you what the issue is, but you’ll still have to figure out how to fix it. If its setup correctly AND/OR you are upgrading from v1 Caddy, it will reacquire new certificates. You’ll know the reverse proxy is set up properly once you see the message
2020/05/05 02:19:54.617 #[34mINFO#[0m serving initial configuration
Once you successfully run caddy and it has a good time with your config file, Caddy will ask you to enter your email address. You can enter a real one or a fake one, but this is for your Lets Encrypt certificate. I chose to enter a real email address. Note: I didn’t have to do this when I upgraded to Caddy v2, but I felt this was appropriate to keep in the v2 guide
5. Testing
You can test this by using your cellphone that is connected to your carriers internet and not your WiFi(dO yOu GuYs NoT hAvE pHoNeS?) and navigating to the hostname you created earlier.
Once you have this all successfully done this and Caddy is full functional, you will have to re-add the server on media app. When you re-add the server, use the hostname you entered earlier, but it HAS to be entered as HTTP : //example . ddns . net (remove spaces) and delete the port number. Take note on the HTTP. I’ve also encountered that in some instances if a port is required, you can enter port 443.
Now that you have all that setup, go ahead and experiment with other services if you have them running, but you wouldn’t dare use sonarr or other similar services to acquire linux iso’s right?
6. Start Caddy as service (optional)
This will create a service that will automatically start and run in the background when your machine starts up, so you shouldn't have to manually touch this again unless something changes.
6.1
Download NSSM
Extract "nssm.exe" from the "win64" folder into a folder named "NSSM" (I extracted mine to C:\NSSM) Open up command prompt as administrator and navigate to the NSSM folder directory. eg:
cd c:\NSSM
Enter
nssm install Caddy
A box should pop up. Set the path to your "Start Caddy.bat" file. Go to the Log on tab and log on with a username and password (Use the Administrator account. Click the "Install service" button.
Back in your command prompt window type
nssm start Caddy
The service should start and shouldn't have to manually touch this again unless something changes.
7. Closing
If you have any questions, drop a line below and I’ll do my best to help.
REMINDER: I am not a networking expert and this is what worked for me.
8. Resources
Caddy v1 guide. You might be able to find some helpful information in comments.
/u/DesertCookie_
points out that this guide is written for IPv4. For places with IPv6, I’m sorry I don’t have any information on how to get it working. I do know he successfully got his reverse proxy working using a CloudFlare certificate and caddy and that I asked him if he wouldn’t mind writing up the process for that. Follow his guide on the old v1 guide, but you are on your own for troubleshooting unless he updates it
/u/tonofun
tonofun's guide that they created since this helped me a lot to.
9. Edits
05/05/20 - Fixed some spelling and grammatical errors, cause I done goofed.
05/05/20@1400 - Added section 6.
05/07/20 - Removed Email section from the pastebins and added an additional section (3.3.1) that is optional.
-----------
i have a few additional comments..
yougetsignal's port forward checking tool works really well. use port 8096 in the box. if it's open, groovy. if it's closed, you'll have to go into your modem's (not router) admin page and forward the port. if you use xfinity/comcast, the modem admin panel wants you to use their shitty app.
to get to port forwarding within the xfinity app:
WiFi -> View WiFi equipment -> Advanced settings -> Port Forwarding
you should see your router name, click [edit]
scroll down the bottom and you should see "Add Port Number"
click that, use 8096 as the port and TCP/UDP as the protocol, hit apply and you should be good to go
additionally, if you don't run Caddy or Jellyfin as services and you use windows, stick a shortcut in the startup folder.
WINDOWS KEY + R -> shell:startup
TrayIt! 4.6.5.5 (majorgeeks | madassnews) can automatically minimize a program - or group of programs - to the Systray (near the clock) when it is minimized to the taskbar.
caddy_startup.bat
DUC
jellyfin
will all start from the startup folder and automatically minimize. out of sight, out of mind
