LINUX Unplugged - 642: Tunneling Home for the Holidays

Episode Date: November 24, 2025

Chris cooked up a wild remote-access trick for Jellyfin that skips VPNs entirely. One tiny toggle spins up a secure tunnel on demand. Simple, absurd, and shockingly effective.Sponsored By:Managed Nebula: Meet Managed Nebula from Defined Networking. A decentralized VPN built on the open-source Nebula platform that we love. 1Password Extended Access Management: 1Password Extended Access Management is a device trust solution for companies with Okta, and they ensure that if a device isn't trusted and secure, it can't log into your cloud apps. CrowdHealth: Discover a Better Way to Pay for Healthcare with Crowdfunded Memberships. Join CrowdHealth to get started today for $99 for your first three months using UNPLUGGED.Unraid: A powerful, easy operating system for servers and storage. Maximize your hardware with unmatched flexibility. Support LINUX UnpluggedLinks:💥 Gets Sats Quick and Easy with Strike📻 LINUX Unplugged on Fountain.FMLUP's Great Holiday Homelab FormOld Fart Form (markdown)ngrok — Go from code to global in just minutes with a developer-friendly, idiomatic solution for managing traffic to your APIs.Jellyswarrm — Jellyswarrm is a reverse proxy that lets you combine multiple Jellyfin servers into one place.Sveske-Juice/declarative-jellyfin — This repository provides a Nix flake that allows for declarative configuration of Users, Libraries, Plugins, Settings, etc. Jellyfin 10.11 is NOT SUPPORTED.declarative-jellyfin full exampleZigl3ur/jellyhub — JellyHub is a web app that allow you to fetch media from all of your jellyfin servers and regroup it in one place, so there is one place to search for specific media and tells you on wich server the desired media is located.Smiley-McSmiles/jellyman — Jellyman is a lightweight BASH CLI tool for installing and managing Jellyfin. As well as create a full backup (automatically or manually) so you can move or import all your metadata and user information to another machine.LSchallot/JellyRoller — JellyRoller is an open source CLI Jellyfin Controller written in Rust that works on Windows and Linux. Its primary purpose is to allow administration of a Jellyfin application from the command line.kjtsune/embyToLocalPlayer — etlp (embyToLocalPlayer) is a tool that lets Emby, Jellyfin, and Plex play videos using your local media players (like mpv or VLC) instead of the built-in web player, while optionally sending playback progress back to the server.Pick: subgen — Autogenerate subtitles using OpenAI Whisper Model via Jellyfin, Plex, Emby, Tautulli, or Bazarr.

Hello, friends, and welcome back to your weekly Linux talk show. My name is Chris. My name is Wes. And my name is Brent. Hey, jents. Well, coming up on the show this week, I have finally cracked it. I love jellyfin, but there's been one thing that's been lacking that's kept Plex around. Well, I have a wild remote access trick for private self-hosted services like Jellyfin.

And now, I can share my Jellyfin instance with friends and family who can't join my mesh network. It's simple, it's absurd, and it's shockingly effective. And then we'll round it out with some great picks, some boosts, and more. So before we get into all of that, we've got to give a shout out to our virtual lug. Hello, Mumble Room. Time appropriate greetings. Hello. Hey, Chris. Hey, Brent. Hey, guys. Hello, up there on the quiet listening.

too. I see a little crew up there hanging out with us. Mumble Room is always rolling. Jupyterbroadcasting.com slash mumble. And a big good morning to our friends at Defined Networking. Go meet Managed Nebula from Defined Networking. It's a decentralized VPN built on the Nebula platform that we just absolutely love. Every now and then a darling comes along, I think it was West, caught it first, and then we lock in and we track it from basically birth to, you know, product. And it started in 2017 to secure the Slack network, which had to have robust security and decentralization from the very beginning. I mean, this is, this is Slack's bag, right? And so

Nebula has the best in-class encryption. And what really matters for me is the design. You can use the managed product for up to 100 free hosts, no credit card required, support the show. It's a great product. And if you think to yourself, this is something I'd like to build my businesses network around, they can help you with that. Maybe your homelap. But maybe you, get to the point where you want to manage the entire thing. Everything can be completely self-hosted. It's not something they begrudgingly support that's available that doesn't have all the features. It's what they build their product on top of.

And when you think about your network infrastructure and long-term planning, those little things, that 10, 20 percent gap really makes all the difference. And it's such a fantastic product because it puts very little load on your machine, low load on the network and low load on the CPU. so your battery life lasts longer on your laptop and your mobile devices, and your server isn't busy with a bunch of that nonsense. You got to go check it out. Get started for 100 hosts absolutely free, no credit card required.

Go to Defined.net slash unplugged. Redefine your VPN experience at defined.net slash unplugged. All right, we have decided to do it. The great holiday homelab is coming up. Pay attention because we're going to need you to submit your homeland. to this special. And I will have links. I'll have all of it set up for you.

It's something we're doing in place of the tuxies this year. It's our first, very first edition of the Great Holiday Home Lab special. And we want to see your setups. It's a magical time of year. It'll be coming up before you know it. It's just a couple of weeks away. So it is our first community showdown of your questionable wiring, you're crazy tinkering, maybe you're downright impressive builds.

I don't know, maybe you got a real clean setup. I want you to enter your homelab big or small to Linuxunplug.com slash holiday. And it is a Google form. Don't think you have to log in, but if you hate Google Forms, I have a solution for you. It's all available. You can just copy and post it into an email. Go to Linuxunplug.com slash old fart.

that's Linuxunplug.com slash old fart if you just want the markdown version. I'd like you to submit a couple of photos, a short description, your hardware list, and tell us what your home lab actually does. And then you're in. And we're going to have a couple of different categories. We're going to have the Grand Rack Award,

which will be 100,000 sats. We'll have the Silver Sudo Award, which will be 50,000 Sats. The best effort award. He doesn't have to be perfect. The best effort, 10,000 sats. And then the LUP Rescue Mission. One home lab that's in such bad shape.

Maybe you tried. A lot of heart went into that home lab. A lot of effort. The three of us, the boys, we're going to get connected on a remote call. We're going to run down what's going on. We're going to help you get things in working order and do a little Lupp rescue mission for better for worse.

I feel like you're talking about my home lab here. Oh, wait, we've already done that rescue multiple times. What's going on? Why won't that stick? You know, it's like the shoemaker whose kids have horrible shoes. So, you know, we're probably going to record that session, and depending how it goes, we may turn that into an episode as well if you end up on the LUP rescue mission tier. So we're going to have each homelab, we're going to look at its functionality, your design,

your ingenuity, your creativity. Efficiency is a big one, too. If you have documentation, that'll matter, your personality, your creative solutions you've come up with. We're going to have a zero to ten per category score. Each one of us will give scores. You know, we'll have things like the lowest functionality but best personality, maybe a disaster story might earn the rescue, something like that. So the entries are open right now. I want you to submit your home lab, show us what you got, even if it's totally chaotic. Hey, my wiring often looks horrible. No shame in that. We may judge you and call you out for it, but don't worry a lot of us have it like that. We really want to see what you got. So submit it. We'll have links in the show notes. And again,

it's Linuxunplug.com slash holiday or Linuxunplug.com slash old fart for the great holiday. HomeLab, Extravaganza! And do get them in quick, because we're going to be recording our holiday episodes before you know it. And I can't wait to see what you guys have come up with. We cannot participate ourselves, unfortunately. We'll have to do our own rescues later on our own. Been disqualified already. Jeez.

Okay, so I wanted to solve something that's really kind of been eating at me since about two years ago when Alex and I did the jellyfin January challenge, I think it was. And it'll be two years, I think, this January. And jellyfin's been fantastic. The migration to Plex was really smooth. I use infuse on an Apple TV, which sounds like a why would you do that kind of setup, but it actually, after trying all the things, really has been just a fantastic way to consume media, really flawless. The two combination are great. And I do take advantage of some jellyfin plug-ins, and I use the jellyfin web interface from time to time. But I've had to keep one Plex instance around because friends and family like to sometimes check in on the old

media library. Maybe they're traveling or whatever and Plex is installed on a lot of stuff or it's easy to get going on anything that has a web browser. And so once or twice a week, friends or family are streaming things from a Plex server that I don't actually use for myself. And I thought about this problem because when you're at a hotel or, you know, it's a friend's computer, you don't necessarily want them to just randomly join your mesh network, and I don't necessarily just want to build a public jellyfin server that's available on a VPS all the time that's going to get banged on. And I don't want to have my ports forwarded on my firewall permanently to my jellyfin instance. And I might want to solve this for other self-hosted software that isn't

jellyfin. And so this is a problem that I have tried to figure out for quite a while. And obviously something Plex handles really well. I know neither one of us, none of us are really big Plex users, but occasionally, you know, we might dip in just because of the share feature. Yeah, absolutely. And it's one of those things, right, where you just kind of got maybe folks who were less technical, still kind of had a Plex account because they had other friends who were sharing Plex, just there was a lot of stuff that ended up being, you get tangentially sucked in.

And that meant that it was also very easy to take advantage of them doing sort of, hey, we're the SaaS company that's willing to do free proxying for you and post the auth and make it easy. Wes, you've had a really nice solution to this that you've used historically. I know, I've used it a couple times. What has randomly spin up a jellyfin server, watch a TV show and then destroy it move? Quite on demand, too. I think you've optimized it as well. Yeah.

I mean, I did think about this. I have a tip. I'm later in the show. I have a tip for how to do this. I haven't adopted yet, but that's even better. But yeah, yeah. I wanted something that would let us continue to watch, like the TV shows that we've been watching. Like right now we're watching the first season of Mary Tyler Moore while we eat dinner.

And if we go out somewhere that has an internet connection on a web browser, I would like to be able to stream my jellyfin instance. And so ideally I wanted to set up with no special VPN required, no weird stuff for the user to do, no weird stuff for me to have to do. And there's a lot of ways to crack this. And we're going to talk about some after I tell you mine. And if you have tailscale, for example, you could use a tailscale funnel. If you're a pretty big cloud flare user, you could probably use a cloud flare tunnel. But I wanted to try solving this with something I've never used before, but I've heard a lot about. And it's a service called NGROC.

And it looks pretty straightforward. That's one of the things that appealed to me. And it's a self-hosted sort of ingress as a service or a secure tunneling platform on demand. And you do run a small agent on your box, and it opens up the outbound, outbound connection to NGROC's cloud, and then NGROC generates a public URL that forwards traffic back to your local service, whatever you might be pointing it at. And it also, very conveniently, it handles the HTTPS certs. So if you're using it for free, you can use three online endpoints and a gigabyte of bandwidth

and 20,000 HTTPS requests a month. And then they have paid tiers to start around $8 or $5 a month. They give you more. And that's particularly convenient for a jellyfin, right? Just because not every app, but some combos of certain apps really prefer your jellyfin server to have a TLS or certain certificate. Yeah, a lot of the mobile ones. Or you don't even care because you're just trying to stream media that isn't secret at all. But.

Yeah. Yeah, a lot of the mobile apps and a lot of the basic kiosk web browsers, which was one of the things that was a requirement is this would work on a basic chromium kiosk browser. Also helps for some casting situations if you're going that route. Yeah, right, of course. So that was something that I wanted to try, but I also needed a way to toggle this on and off because I don't want to leave it running when I'm not personally watching TV. And this proposes an interesting challenge because a situation we find ourselves in, we're at an Airbnb or a hotel, and we want to watch some Star Trek.

I don't want to have to SSH in or I want to be able to toggle it on really quick or my wife. I want my wife to be able to do it as well. Right. You wanted something where you didn't have to, like, go manually stand up infrastructure or wire your stuff together, like, not have to set it up with an intention before, like, a big trip. You want to be able to, like, on a whim, on a Saturday. Yeah, I didn't, I don't want to have my jelly thin server on the public internet all the time. You know, so something I could easily toggle on and off remotely was really kind of what I was going for. So this still feels like you're exposing yourself to the public internet, really, because if you didn't feel like there was some kind of risky.

wouldn't need the toggle, right? You just leave it on all the time. So does this feel like the ultimate solution or just a step towards? Yeah, you're right. I mean, it is still a problem. I mean, it's a really crazy NGROC URL, so there's a little bit of obscurity there. Right. But then, of course, I do the right thing, and I have a DNS redirect that makes it a really simple URL, so that way I don't have to type a crazy NGROC URL into a key off device, which probably makes it easier to discover. This is something I'd be curious to know what solutions I can employ at this stage, maybe, you know, I could do IP whitelisting, but the issue there is I don't know what IP I'm connecting from. You know, it could be cellular

network. Yeah, and you won't if you're at a random Airbnb or hotel or wherever your cell phone gets assigned today. And if it was just you, you would use your mesh network, right? That's the obvious solution here. But do you want to let Wes and I connect whenever we want to or whenever we can convince you to flick the switch, right? Yeah, so that is, I think, the downside to the setup is for a period of time, there is a way public internet could discover your jellyfin server. Now, the way NGROC works is when you go to the URL, at least on the free tier, there's a page you have to go through first to say, yeah, I know what I'm doing. So that might slow down some automation. I doubt it, though. Ultimately, what I rely on is keeping my

jellyfin server secure and up to date and isolated still. Yeah, I was going to say, like, obviously defense in depth, but there's also, you should be realistic about what your actual particular threat scenarios are and you know how do you does your jellyfin have uh is it all just guest accounts and um default passwords uh is it does it have access to the rest of your box or is it in some sort of container or virtual machine or thing that just has access to the media and do you have sensitive stuff in your media are all things to yeah that may make you care more or less depending on how you've got it set up if it's just like a dedicated virtual machine that only has like a limited stuff mounted in from the host, maybe it's not a huge deal.

If it's, you know, running on your box where you also do all of your backups and stuff, then maybe it's a bigger deal. It does seem like in terms of application complexity, because it is a very complex application with a lot of stuff under the hood, a lot of ffm peg, and it has access to hardware acceleration, you know, of the apps, I'm going to make temporarily public. It feels like maybe the dumbest one to actually make temporary public because there's, honestly, there's a large attack service there may be off bypasses for all I know ways to trigger the server to do all kinds of crazy DDoS indexing and in transcoding I mean who knows right I mean it has to be something you consider in the setup I think which is why the toggle I felt like was so important because then I'm at least you know I'm watching a half hour episode of Mary Tyler Moore okay so I have a 40 minute window where I have this really crazy obscure URL and all of that but something I would really like input on is layers of protection I could do here or some other, some other maybe second order authentication I could do to enable

this, to authorize certain connections, like if you have any ideas to boost in or give me a little bit of feedback on this because that is something that is not ideal and I do want to disclose it's a risk here. But ultimately, I was very, very happy with the setup that I ended up with. Unraid.net slash unplugged. Unleash your hardware and unlock your systems full. this Cyber Weekend. Unraid Cyber Weekend sale is almost here. So the Black Friday through Cyber Monday sale runs November 28th, as you're listening, that's this Friday, to December 1st. You can take 20% off starter licenses and 25% off the Unleash license and upgrades. Every starter or unleashed license also gets you a voucher to the Unraid merch store, where you'll find

an all-new graphic teeze, jackets, hats, and backpacks, 20% off the entire lineup. And that's through the new year. It's not just a sale, though. It's really a celebration. Remember, Unraid is celebrating 20 years of freedom, performance, and control. Is your system unleashed and are you? Well, it is the time right now. So get started.

Support the show. Go to unrayed. Notting. Unlock your system's full potential and take advantage of the cyber weekend sale running November 28th through December 1st. Take 20% off starter licenses and 25% off that unlock. lease license and the upgrade. That's a great deal, plus the merch voucher. So check it out, support the show. It's unrayed.net slash unplugged. Well, you mentioned wanting to be able to turn this on and off, I'm assuming, from the sofa or any sofa in Airbnb or at home and have the wife be able to do it, which is, it sounds like quite a challenge, Chris, but you said this, you pulled this off in a nice way.

So I'm waiting to see what do you got? You know, as the years go by, my go-to solution more and more for this type of stuff is make a button and home assistant for it. It's such a flexible, powerful platform. Should have guessed. Yeah, it works great for this kind of thing. And, I mean, maybe not for everyone, but you are already committed to having it available and plumbed to basically all of your devices, right?

You want that. So you don't have, you don't not paying a cost for like a new separate whole, you know, bookmark. a whole bunch of stuff. True. And it's something I'm already maintaining and making sure it's highly available and et cetera. But also, the thing that played a big factor in my decision making is it's on the wife's phone, right? The kids know how to use it. So it already has family workflow. So I'm adding a button to a thing they're already using. I'm not asking them to go use a new thing. And I cannot tell you what a difference that makes in family

adoption. It's a difference between them using it and not using them. So plus it's just really awesome. I wanted a small little button, and I already have a dashboard that's for our media playback that has a, you know, a mock remote control, and it has our music assistant controls. You can control the different speakers in the house from this one dashboard already. So this is where you already go to do TV stuff. I'm almost imagining, like you have a TV button on the wall that you hit, you know, and then it starts the TV up, and then the TV turns on, and then the switch is toggled, and you're ready to go. Well, I absolutely could. I absolutely could. I have could map it to a button, right?

I could conceivably even map it to just a hardware button that I take with me in my bag. Or for the kids, it has a little countdown, and then the button turns red again, and the TV put on. I would like to know what you called the device in Home Assistant. You probably came up with a good name

or you need a better name, right? No, it's just, well, yes, I do. It's just jellyfin tunnel. Lame. Maybe it could be like a media conduit. I don't know. I like that. I tend to give Star Trek names

because then it sticks out. You know, like media, Yeah, subspace relay, subspace media relay. Something like that could work. But the other thing, too, that I didn't want to have to deal with is I didn't want to have to do the crazy NGROC URL every time because I'm not going to remember that. And I'm picturing like an Airbnb. I'm picturing a kiosk. And I'm picturing a basic web browser or I'm telling a family member over the phone.

And I don't want to have to give them this crazy URL. So when I hit this button, not only do I want the tunnel to initiate on a different box, but then I also want to retrieve the crazy rando engroc URL I just got, and then I want to go update my Cloudflare DNS entry with a redirect to point a static DNS name at this new crazy URL. And all of that happens with a push of a button. And it's so great. And honestly, it was really made possible because I created a little Rest API with a tiny little Python server that I vibe coded. I'll just admit that. Oh, yeah.

Very simple. it's only got like four functions so it's not like it's very it's not like it's very powerful or very complicated but what it does is it listens for essentially an HTTP rest request from home assistant and that either tells it to start stop or check the status or get the URL so in home assistant I can show if the tunnel's active I can light the button up when the tunnel's up or down and I have history of how long the tunnel's been active when it was activated. And I can also display the NGROC URL and Home Assistant if I wanted to. Ooh, that's nice. Yeah. That's really, really fantastic. I did play around with Cloudflare

because they don't have the bandwidth limitations until you go too far. And because I'm hosting the DNS on Cloudflare, it kind of made sense to just do it all in one place. But honestly, the complexity is more significant. And so, and I've just found Engrock to work really well. And then In Home Assistant, I created a manual rest sensor, and it's just something you add to the Home Assistant config.comfile file, and it's probably five lines of YAML, and it just identifies a new sensor type. And I give it the URLs for the sensor endpoints to go talk to the Python server, and then that's how it triggers and reads the state. And while it sounds kind of like hacking a bunch of scripts together, it's because it's so simple, and because I'm used, using the Home Assistant Automation and Architecture, it works really well.

So I have the Home Assistant Dashboard, which has a switch for the NGROC Tunnel, which then sends the Rest Command to start or stop the NGROC tunnel. Then using the API, it pulls back the status of the tunnel. It updates my DNS record with that new URL from the status. So is Home Assistant doing that, or your Python automation? My Python is. When the API, after the Python script starts the tunnel, it retrieves the URL and updates the DNS just right back to each other.

Gotcha. Yep. But then it delivers that back via the API to Home Assistant as well. And then how does, do you have to like set certain stuff in Home Assistant in terms of like fields to pick out of the response? Is there a standard protocol in terms of like, you know, reading like use this field to tell if it's up or down kind of thing? Yeah, because it's just giving back really simple JSON like, yes, up down, you know, status is active, inactive. That's basically it. That's all it is.

It's so nice. But by that, I essentially get status monitoring. By looking at the button, I can tell if the tunnel's up or down. But then if I want, I can go into the button and I get an additional history of all the time the tunnel was used. And then what I did is I essentially start that Python API server with a system D unit. So in the system booths, it's just running via system D, that little Python listener. And then that guy also is what like interfaces with NGROC's API, right, which is sort of like, hey, toggle this tunnel on. And then as long as you have separately that little tunneling demon running and available, it'll pick up on that automatically.

Yeah. Cool. And then it's using the CloudFlare API, which I had to go create an API key, obviously, for the different zones that needed to manage and whatnot. And it's using that to do all the DNS and redirect on my subdomain that always remains the same. So I always just go to the same URL, and I always have to, I always have a vanity URL for it. I never have to worry about anything. And then when we're done, I just pull up the Home Assistant app on my phone. tap the button on the media card, on the media dashboard.

And it takes about 10, 15 seconds, and then the tunnel closes. That's it. And I had you boys try it this morning, and I just told you what URL to go to, and you do get an NGROC screen. But I'm curious to see what your impressions were. I'll start with you, Brantley, since you were probably on the most remote sketch connection out of the two. Well, it's just what it is. Yeah, I have to say it just felt like the native experience. aside from that NGROC screen that you get to say, yeah, yeah, you know, I trust the person who sent me this weird crazy link, which I'm not sure I should answer that.

But then I just got the, you know, usual jellyfin interface and stole your credentials. And it seemed to work perfectly fine. There was a little bit of buffering on my end. But I think we figured out that that's because it was, your box was doing a little bit of transcoding to send it my way. not because necessarily of bad connections, but just because of hardware? Was that your assessment as well? Yeah, that spaceballs was 4K, UHD.

That was the only thing to test with. I couldn't find anything else. No, of course not. No. I don't know. So, Wes, I know it's not the most performance solution, but if you took out that NGROC prompt screen, which I think would go away if I paid for it,

it feels like a pretty seamless solution. Like you wouldn't even know. You just go to any web browser and Jellyfin just comes right up. Yeah. One thing I wasn't sure that I didn't check. when I was looking at it was, are you doing like a cloud-flair proxy

to apply a correct cert name, like, on that level? Or does Engrock get that right? Yeah. Or maybe Jellyfin just doesn't care? No, Jellyfin cares. But do you tell them? Because then you're adding your own, like, wrapping layer, right?

I wonder if maybe it is, it is probably also solved at the cloud field level. It's just, I don't recall going through that process. But in any case, like, at least doing it in the browser. I didn't do like a complicated app or... You don't have to, like, Like, do like a fake search. Just fine, yeah.

Yeah. Yeah. And it is interesting. You mentioned possible limitations with bandwidth. Again, you're using a free plan from a thing, so there's risks with that. And I think as far as I knew, I've never used them extensively. But I think Encrox started from like doing, making it easy to expose staging, developer and stuff, right?

I'm working on something developing over here. And I want to do a demo and share that. Yeah. So here's my API on my private box is really. Yeah. And I, you're right. And I do think if you were going for raw. performance. Cloudflare is probably better because their network's a little more robust.

And additionally, they don't have that one gigabyte limit on the free plan. So there's that. However, I really like NGROC, so I'm not necessarily inclined to change it. Well, and as you saw, right, like it was, the U.S. was good. It was well supported out there. There's a lot of examples. There's API integrations for it and all that. So there's a lot of benefits, too. The cool thing is, because I kept the configuration and Home Assistant itself to something really basic, it's four or five. lines of Hamel, I can change out NGROC and Cloudflare and keep the Home Assistant part working because I just keep the API endpoints the same if it's NGROC or CloudFlare. And then I don't have to readjust anything in Home Assistant and it keeps working.

I tested this. I swapped out to Cloudflare tunnels temporarily and just kept the API URL endpoints the same, even though now it's not NGROC. And it works. So that flexibility I really love, in a sense, it's modular, right? The jellyfin, the media server, it could be Plex, it could be sync thing, it could be my documentation, it could be my loop logger, it could be any app, and it can be any, it could be Engroc, it could be funnels, it could be channel tunnels, it could be any tunneling technology you want. And then with home assistant, that just stays agnostic as well. But they all really seamlessly work together.

And I don't ever manually start this tunnel, even though I don't ever manually start this tunnel, even though I'm I know the command to start the tunnel. I don't ever, I just, oh, I just bring it up on Home Assistant and start it. Like this morning, when you guys wanted to try it, I had that cessation of that box, I'd open up my tab and went over to Home Assistant and I started the tunnel that way. Yeah, I hit the button, yeah. But like you said, right, you get the dashboard, you get the metrics, you get the like statekeeping, all that kind of stuff for free.

It's nice to solve this problem, but it's not the only way. And Wes, you played around with something called Jelly Swarm. Yeah. You know, you kind of touched on it earlier. Like, you transition to jellyfin, and it does a lot that we love. But there's some kind of areas that, like, it doesn't really compete with Plex in the same way. It kind of offer the same functionality. And so I just took this as an opportunity to go look around and see what tooling folks were building and working on that might sort of fit. And so we'd been kind of curious around, like, proxies or ways to share servers before.

So Jelly Swarm advertises itself as a reverse proxy that lets you combine multiple Jellyfin servers into one place. If you've got libraries spread across different locations or just want everything together, Jelly Swarm makes it easy to access all your media from a single interface. Multiple servers. Yeah, I haven't done that.

remotely. I've only just got it set up. But yeah, so you can proxy one server or proxy multiple servers. Oh, I could see us using this for a different, let's say, purposes. Yeah. Unified library access, browse media from multiple jellyfin servers in one place, played content straight from the original server.

Yeah, do you want to try it? Yeah. Yeah, I want to try it. You got it up? You got it up right now? Is it working? I bet you it's running off his laptop right now. Yeah, it is.

So don't go crazy. Don't go crazy. Great. All right, all right. I'm going to just use the traditional login. Go ahead and remember. Oh, no. Is that not the traditional login?

Oh, is it Chris F? No, no space in the password, too. No, of course not. We don't do spaces. I'm not here for thinking spaces. There we go. I'm in. Boy, it's fast, Wes.

That's on your laptop. Yeah. And then you should, if you, I don't know if you can mute the tab or something. I don't know if you want to try it to see if the video will load. It's spinning and loaded. Boom. Right into Deep Space 9. Yeah.

All right. Season 2, episode 13. Armageddon game. Wes Sneaky had me test this last night without your knowledge, Chris, because he knew he's working on a competing solution. And I think he wanted to win. I got to say between the two, Wes is a little smoother. There's no like, yes, I need to trust this crazy human URL and also it loaded pretty quick. But the coolest feature I saw was user mapping.

Wes, you want to write us through that? Oh. Yeah, actually, Chris, if you pull that URL back up, if you add slash UI to it, I think it'll take you to the management interface. Oh, yes, it does. swarm admin interface. And then same password, but use Wes as the username. I do love our security practices. Okay. Is it, is it, uh, Wes P or is it just, no, just WES. It should be. Oh, no, it's admin. Sorry, it's admin. Now we know what Wes's password is. All right. Now we are in. I see. So I have one server listed. Yeah. Yeah. So this is Jelly Swarm. It's, it's a rust-based app. It's got like a just a little

minimal web server that it hosts as well as being a proxy that shows its own full Jellyfin UI. And so you, it's pretty simple right now, really early days for the project, I think. But yeah, you've got servers you can configure, users, and then some basic settings. So the first thing you do, of course, is, well, what are you proxying? And so this is where it's being proxied over a mesh network back to my laptop. But you can see here where you could add multiple ones. They have a priority field, which I haven't played with. How are you getting this public to the internet?

For this demo, this is just running on a, the proxy is running on a VPN. I see. And then talking over the mesh network back to my server at home. That is a very nice solution. So you have a VPS that's got a mesh network interface, and then it can proxy these. And it works really well. And it's like three fields to add a new jellyfin server to this, as long as it can access it. And then if you go to the users tab, you'll see one thing that's interesting is, like, it does a layer of mapping.

So it has its own directory of users, and then you choose how to map those onto the credentials to the actual jellyfin servers that it's being proxied to. So, like, I was able to map both of your guys's fake proxy accounts onto the one Wes account that I have on my actual jellyfin server. Yeah. And you could do it other ways, too, right? But, like, that gives you a lot of flexibility, I think. Wow, that's great. This is really, really cool.

Huh. Now, one downside, I saw in this early version, I don't know if they're going to try to fix that or what. One part, I did have to still set up, like, a full forward to my jellyfin instance because it, when you, everything worked in terms of being fully proxies. through Jelly Swarm, except when I would try to play the media. And it looked like for that, it was still ultimately getting served a link to the backing Jellyfin server. So if you knew the right, if you were watching the network traffic, you could go figure out, like, where the backing server is that's being proxied from that same VPS.

But you don't have an account for it because you have credentials that are only valid for the proxy. And I think eventually, right, it could be that this is able to proxy the media too. I don't know what the full plans are there. So there are some caveats, but I was impressed, honestly, with how well it worked. I was able to test it with doing a Chromecast here at the house. That was totally fine. And it works just fine with the Android Jellyfin app, too. Well, I see it's still actively updated.

It's kind of a new project, but it's under Active Development. Last four days ago, things were created in last week, a bunch of stuff. And it's GPL 2.0. It is JellySWorm. Bring all your JellyFin servers together. I think this is the route I'm actually going to go for JellyFin. Because then we could also, over time, we could add each other servers, which sounds like a lot of fun.

And then this tunnel thing I've come up with seems useful for other types of self-hosted services that I want to temporarily make available. I like JellySWorm a lot. So it's Luke As 22 on GitHub, and we'll put a link to this in the show notes. I did also see just a quick smattering of other things that maybe worth checking out.

Yeah, yeah. Sadly, it has not been updated yet for the latest, like Jellyfin just had that big new release with the database upgrade and all that. So 10.11. It doesn't support it. But there is a flake out there called declarative jellyfin.

Oh, this is up your alley. Yes, right? So basically you can define all your jellyfin stuff in your NixOS setup. So once that's updated for the new 10.11 version, I think that's going to be killer, especially if you wanted to quickly, you know, automate standing these kind of things up

or you just wanted to have a more maintainable jellyfin. You found some good ones. You got a couple of other good ones in here, Wes. So check out Jelly Hub. It's a web app that allows you to fetch media from all of your jellyfin servers and regroup it into one place. So there's one place to search for specific media

and tells you on which server the desired media is located. So you could kind of see some combo of like Jelly Swarm and Jelly Hub. Maybe that starts to get you a little more to like theplex. Oh my gosh. This is, you know, this is so great for me because I have a, I have a couple of disparate smaller jellyfin servers. And then ideally, of course. Right, subfins.

And then you'd have like a central fin at the server, right, the main fin, the main, that. And it's also GPL3, Jelly Hub. I also found jelly man and jelly roller which are both like a set of scripts and or CLI utilities meant to help manage your jellyfin so if you do start automating and rolling things out you can check those out and the docs were entirely in Chinese so I did my best to translate it but MB to local player

which is something I've wanted before because one of the great things about jellyfin right is it makes it super easy to just download or to get direct stream access to the media without having to fuss with its UI or anything. Well, MB to local player basically automates doing that, but with hooks to go back and try to sync your watched status, which is what you lose if you take things out of the whole system. Oh, that's brilliant. So imagine just like using MPV to watch your video locally

while you're working at your desk and then still have that data in the system. Wow. Nice finds. Very nice. We'll have links to all of that in the show notes. of course, also would love to hear your crazy network tunneling solutions and security solutions for my setup. Like, you know, maybe if I keep using this, I should build in some security. So boost in and let us know. It's a great way to support the show and share the knowledge and links to all of this in the notes. OnePassword.com slash unplugged.

Take the first steps to better security for your team by securing credentials and protecting every application, even the ones you don't know about. Learn more at onepassword.com slash unplug. That's the number one password and it's all lowercase unplugged right there. You just go there and learn more because this is something that would have changed the game for me when I was in IT. If you're in IT, if maybe you're in security as well, you know what a mountain of different assets, there's physical hardware, there's user identities, there's applications, and it's a lot and it's always growing. Well, you can conquer this continuously growing mountain of security risk with one-password extended access management.

This is a huge issue. You're not alone. This has been identified as a major problem out there. And this is where One-Password is trying to make life better for both users, IT, and security. And they have Trellica. This is something that can discover and secure access to all of your apps, managed or unmanaged.

Trellica by One-Password inventories every app and use at your company. It has pre-populated app profiles so it can assess the different SaaS risks. It'll let you know who has a lot. access to what? You can manage that. You can optimize the spend. You can even enforce security best practices across every applications your employees use, and now you're going to know which ones they're using, even the shadow IT. I also really appreciate this because I know so many companies struggle with onboarding and offboarding employees. You have a process that lasts for a little while. This needs to be better, and this is an area where one password can help. It can help

you meet compliance goals. It provides a complete solution for SaaS access. governance. Trellica by one password is just one of the ways that extended access management as an entire suite helps team strengthen compliance and security. You know about their award-winning password manager. I use it. Family members use it. It's trusted by millions of people. I was really thrilled when they came to Linux. Businesses all over the world use it. This goes way beyond that. They're securing more than just passwords with one-password extended access management. This is something that would make life easier for me, and I think it'll make life easier for you. So take the first steps to better security for your team by securing credentials and protecting every application, even the unmanaged ones.

You can learn more by supporting the show and going to OnePassword.com slash unplugged. They have a video there you could watch. That's the number one password.com slash unplugged. All lowercase. Go learn more. OnePassword.com slash unplugged. Join CrowdHealth.com and use the promo code unplugged. making informed decisions about health care is getting tougher and tougher.

It's also becoming a political football, which makes it very frustrating. But it is open enrollment season. That's the season where the health insurance companies are going to hope you'll just sign up again and just swallow those overpriced premiums and the confusing fine print. This is where crowd health comes in. I have been a member for over three years. And don't take my word for it. Go check it out.

Go to join crowdhealth.com. It's a health care alternative for people who make their own decisions. I'm a small business owner, very small business. This was a absolute must-do for us. My wife and I both own our own businesses. We have saved thousands of dollars using crowd health. Stop playing that insurance game. Go join crowd health.

It's a community of people that fund each other's medical bills directly. No middlemen, no networks, no nonsense. I see so many success stories on social media all the time. But as a member myself, you know, just being in the system, I've watched the process work and I love it. You know, I'm very comfortable with it. It gives me peace of mind. I have seen the system work over and over again. And they have a great app to manage all of it.

It's very straightforward when you're going to start the process, or if you have an emergency situation. You know, you just want, like, kind of like somebody to ask some questions. They have an app that handles all of it. This is crowd health. It's a health insurance alternative. It's health care for under $100. You get access to a team of health bill negotiators,

low-cost prescriptions, and lab testing tools, as well as a database of low-cost, high-quality doctors vetted by crowd health. If something happens, you pay the first 500, then the crowd steps in to fund the rest. This is how things should be, and it lets you take power back here. The system is betting you're just going to stay in the same stuck, overpriced, continually overpriced system. And if those subsidies expire, which they seem like they're going to, prices could go sky high. Crowd Health has saved members over 40 million in health care expenses because they just refuse to overpay for health care.

It's open enrollment, so take your power back. Join Crowd Health. Get started today for $99 for your first three months. Can you believe it? And it's real. It's real. I've done it. It's great.

Go to join CrowdHealth.com. Use the promo code unplugged. It's Join CrowdHealth.com and then promo code unplugged. CrowdHealth is not insurance. Opt out and take your power back. This is how we win and make a difference. Join CrowdHealth.com. promo code unplugged.

Well, we've got a nice round of boosts here, and it all starts with the dude who's abiding. 87,654 sets. Hey, Rich Lifestyle! Coming in hot with the boost. Thank you very much. This is greetings to all, long time, no boost. I'm left behind, currently in the middle of episode 639 and slowly crawling my way to the most recent one. Chris, not sure you decided on a home assistant machine, but I have the blue, and it's been rock solid for four years.

years? Yeah. Wow. It's an O-Droid N2 Plus, which on paper it sits at 2.2 watts idle and 6 watts at full load. I have it connected via POE, and I can see it sips 2.32 watts right now. As for Zigby,

I have an Ethernet adapter. Not sure you can go that route, though. Yeah. Yeah, and also, he says, do you still use Plex? Yes, because of the remote streaming. Well, so far. But check out watch state. which will sync them.

A tool primarily to sync your backends, user PlayState, which is really the thing that's really the big deal. Yeah, and traps a lot of people where they are. Plex, Jellyfin, and Embe. Embe. How about that? And they hit their version 1.0 stable release

on October 29th. There's another great tip. That's a good one. I didn't know about that. There's no reason not to have your watch state synced. Yeah, you've been manually, like, syncing it yourself, watching the episode twice, the whole thing. Like an animal.

Yeah, I just watch them again. By the way, just to cite, quick aside, the Home Assistant Blue is what runs the studio's home assistant automation. It has been very solid. It's not crazy powerful, but the needs here are not as much. Yes, so I will say, I don't know if they sell it anymore, but I will say it has been a very solid machine.

I've been very grateful for the Blue, and I bought it as soon as they announced it. Don't tell you that much. Marcel's here with a row of Mick Ducks. How about that? This old duck still got it. 22,22 sats. Quaker, waka, it's a treasure.

Yippee! That was way too cheap of a ballerboos, so I have some more sets. Thanks for... Have some more. Thanks for taking a look at my setup last week after the show and the post show.

You had a refreshingly balanced take. Still not sure what I'll do. I'm really reluctant to run it in a VM. So far, I've needed that software again. Oh, yeah. Right. At the end of the last episode, we took a look at STM 32 Cube Programmer,

which was proving quite difficult to run on Nix. Indeed. Indeed, indeed. Let us know. Keep us posted. VM could be a right. Maybe a container. I don't know. Our pal and buddy, Jeff, comes in with 14,000 sets.

Simple request this time. I want to hear that live pew sound. Yeah, that hits. Thank you, PJ. Appreciate that. Well, distro's stew came in with 11,000. 101 sets. I like you. You're a hot ticket.

Is that a row of sticks? Thanks for roasting my configs. I use Git a little differently, though. Sync thing is my source of truth. My desktop is kind of the command center, so I mostly edit the configs from my other headless servers there. Then, in a server terminal, I just haven't run the rebuild switch

since the configs instantly sync. Every month or so, I'll actually commit to Git, but this is mostly just for sharing. I generally think Git is too much overhead. I don't want to think about commits, merges, or reverts, just to update a package on the system. Uh-oh, fighting words, Wes. Fighten words.

Actually, I was going to say, I love this. Thank you for sharing distrust, dude. This is, I love that we have the kind of audience that takes the tools and uses them however they want, right? Yeah, sure. Totally great for this. But what I do it that way. When you want, and you can combine the two in a variety of useful ways. It's fine for them, just not for me.

I see how much. Well, hey, hey, you know, I've got to be the Chris config bar razor. Distro just got lots going on already. This has got a great config. All right, all right. Okay, all right. A dude trying, thank you distros, too. A dude trying stuff comes in with a row of ducks.

That's 2,22 cents. Well, I love the idea of the homelab holidays. I'm currently trying to get everything into IAC and pivoting my home lab to Bootsie. Oh, interesting. That's awesome. Side notes. How many sats to add that bit of Chris saying IDK how the world works to the soundboard? I find that too relatable.

Well, somebody's got to track it on. Did I say that? Because that does feel hot. Yeah, if you've got a flack fought for us, I mean. Send us a flack. I can bribe the soundboard guy. Yeah, Wes does have connections. Thank you, dude, trying stuff.

Appreciate that boast. Retro gear comes in with 8,555 cents. They're real and they're spectacular. Jets, check out GitHub, uh, Sawman Net. called it's a project under that org proxmox dash nixOS because it actually works pretty well. I'm running a few VMs on there that can't be done with modules or docker containers. Cheers. Oh, and on Soundbites, have any of you seen spies like us with Chevy Chase to Ann Aykroyd from

1985 full of absolute crackers? I do know of the movie. I have not seen it. I have not seen it. I think there's going to be... Maybe you could put it on your shared jellyfin for us. Right. And sit down and I just need to sit down with a clip machine and just want to...

watching the movie, it sounds like. That's pretty great. Thank you, Retro Gear. Good to hear from you. Yeah, I mean, I have not yet dared to try ProxMox NXOS, but if I was going to go ProxMox, obviously, that's how I'd want to do it. And so having an experience report is super useful. Okay, all right.

This is ProxMox NXOS. We have a boost here from Dirt Ferguson, 13,333 cents. Turg Ferguson. For the Home Lab holidays, consider a category of systems that do the most with the least. Oh, yeah. I definitely think you don't have to have a crack and crazy homelab to enter the contest. You know, it could be a laptop or a pie.

You know, it's just, it's sort of a little bit about what you're getting done with it, too. Now, of course, we'd love to see the crazy cool setups, right? But, I mean, you know, sometimes your home lab's a tiny computer in a drawer. Still send it in. Crazy cool doesn't preclude the eccentric. I'm open to that. No, I think it, in fact, should encourage the eccentric. That's how I'll be scoring, personally.

Thank you, Tert. Appreciate that. Chloriflor is here with 8,000, 1, 2, 3, sats. Well, I'll be dipped. How about that? I don't know, Brent. I think there might be a message in there. Oh, I'm in.

Best Secret Port Boost. Ooh, I think he's giving me a message there. You know what I mean? I know that port. Because that's the 8123, the home assistant? The home assistant board. I think it's the homocystead port, isn't it? Let me double check. I got it right here.

8123, yeah. I got it in a tab. All right. Thank you, everybody who boosted in, including those of you who streamed them Sats as you listened. In fact, 28 of you collectively helped a stack 53,513 of them, Satoshes. When you bring it all together, we got 221,137 sats. That's a pretty cool number.

221-137. We really appreciate it. There's a lot of ways to support the show because it's, It's a value-for-value podcast. Your time, your talent, and your treasure are all very much appreciated. Show's been going on for a long time now, y'all. And one of the reasons is because our audience has made it possible between the interactions we get in the community, the support we get via the boost and the membership, but also your listenership. It means a lot to us. We really appreciate it. Fountain FM makes it really easy to boost these days. There's also ways you can go on the self-hosted Sovereign Route with AlbiHub. Go pick out a new podcast app at podcastapps.com. Not only you get a lot new features, like the live stream, instant updates and all that, but you can also boost.

It's podcast apps.com. Thank you, everybody who boosted episode 642 of your unplugged program. Let's keep it on topic this week. We've been talking a lot about media service. So let's just wrap it up with a pick. It's right on point. It's called subgen, and it auto generates subtitles, subgen, for your media, be it jellyfinplex, XMBC. I don't know what you're using these days with your Xbox's and your media centers.

But it'll do it. It'll generate subtitles and create a dot SRT subtitle for any media file that you add. And it can be, then, you know, read by your assuming you got something that understands SRT files. It's pretty nice. You found this West, and of course it's a Python app. It's been a minute. I'm assuming the way to use this is to process all your media files ahead of time or trigger it if you're getting some new stuff. But I'm assuming some of the Whisper models being so efficient.

You can also use this in real time if you had the right pipeline. Yeah. Oh, that's good. I like it. I think you could. I think you could. Again, can we all just get on board with buffering? Like, start your movie.

And now for your land, you shouldn't have to. But when it comes to content or anything that's getting auto-generated or internet streaming, can we just buffer a little bit? Can let me buffer? So many media apps kill this. Why am I paying for this RAM if you're not going to fill it with pre-cashed videos? A lot of the media services used to buffer more, and now they buffer less. I think we bring back that Flash YouTube player because it would buffer. Bring back buffering.

I feel like if you just played an ad before you got your Jellyfin media playing, then you could do the buffering during the ad time. Have you considered this? That would be really, really cool. Okay, we need a jellyfin plugin that adds our own dynamic adds into it. Yeah, yeah. So there is, speaking of jellyfin though, Wes, there is some jellyfin, like, integration you can kind of do with the jellyfin webhooks plugin. Yeah, I'm impressed with this thing just because it is like you can use it in Bizarre or Plex or Mbby, but jellyfin, you pretty much just use the webhooks plugin, which is standard. I think that's just to like be able to communicate, like when you add new media, jellyfin finds stuff, it can go ping subgen.

And then as long as subgen has like the same mounts. for the file, so it has the same paths that jellyfin shares, then it can go off and generate the SRTs. And, like, you know, obviously these software, like, there's robust support for subtitles, especially if you're getting them from sources or standard media items that have those out on the internet, or if you're doing pinch flat and your YouTube sucking in software, like, does that for you. But if you're like me and you frequently go crazy and stand up wild jellyfin servers, you might not have signed in to open subtitles. You might not have copied everything. You know, Like, you might have a subtitle method of last resort or for random MP4 files you want to stick there.

It just seems great. Very often. And, you know, like one of my kids, they just prefer to watch the movies with the subtitles and not all that has it. So it's really nice to have this as an option. It's MIT licensed, 98.8% all snake. And you can find a link to subgen in the show notes. Now, Wes, if we said something that somebody wanted to go back and find or if they wanted to replay a segment, we probably have resources they could take advantage of, right?

Yeah, they just run subgen on our file. No, actually, we do that already. So you just go check out the RSS feed with a podcasting 2.0 capable client, which is the easiest way to do it. And we got chapters baked right in into the MP3, but also in a JSON file we keep in the cloud. So you get the latest and greatest chapters. But you can also get an SRT or VTT file of your very own and follow along with a transcript.

And it's probably worth mentioning, guys. This is going to be our last few episodes of the year. We're coming in. We have a few things planned still. It's not like we're wrapping up yet, but as far as it gets to, like, episode planning for us, we are in, we are now planning our last few episodes, which means we only have a few more live streams of this year. And as we get into mid-December, some of them are going to be double live stream recording

episodes. We will have the holiday home labs coming up. It'll happen faster than you think. So if you get a little time, when you're around on a Sunday, join us over at jb.live. We do the show at 10 a.m. Pacific, a 1 p.m. Eastern, but you can get a little time. you can have the robot converted to your local time at jupiterbroadcasting.com slash calendar. It is a special live vibe thing.

It's unique in the world of podcasts. And it's not something we brag about or talk about a lot. But do you know any other podcast in the world that has an open mumble room that anybody with a working mic and headphones can join and share their opinion? Now, people don't abuse it, obviously. But it's available.

If they tag me in the chairman, they have something they want to say, they can talk. And that is open to all types of people. Now, of course, you abuse it. You'd probably get kicked out. But it's a really unique aspect to the show. And then you combine that with the live people that are watching and giving his feedback and helping title it in real time. And then the members that finance it and the boosters who give value to each individual episode, it is a very unique thing we are doing.

And then to have been going for so many years, right? I mean, we're breathing down on 700 episodes of doing our absolute best every single Sunday to give you the best Linux coverage. And our only bias and motivation is to give the best coverage to our number one customer. And the number one customer is always and has been our audience. And I just think when you combine the mumble room, the way the show is supported, the ingredients, how long we've been going, our focus and our goals as presenters that we are all three aligned on, it's something very unique. And only a few more episodes of this year will be live. And it gets extra special and fun when you can participate live. JBLive.tv, or if you just want to plug it in on a web browser, jbblive.fm, we're also on the commercial video platforms for the live stream, and of course, members get the entire bootleg. They get a sense of it, but it's a whole other thing when you hear live. I wanted to make that plug, just as we roll into the holiday season, and as we bang out all these episodes, and we have all this stuff, like, we're going to get moving quick, and I might not get a chance to remind you again. And it is something very unique, and it will not last forever, and it is here right now. And it's something very special.

media in my opinion. Of course, I'm a little bias on the topic. So go check out the show notes for more info for what we talked about today. A lot of good resources. Consider a membership. I will probably have a Black Friday sale soon, but I don't have one right now. But we'd still appreciate if you had a membership or wanted to boost the show again with how to secure my crazy tunnel solution. And if you have any questions about it, too, also send those in as well. And check out Linuxunplugged.com just so that way we have a reason to have a website after all. It's not all about the podcast. app, although we try to make it as good as possible. Also links to our Matrix, our mumble, other community resources over at LinuxUMPLug.com, and

that's a submission form. That's LinuxUmpug.com slash holiday for the automatic form, and LinuxUmpug.com slash old fart for the markdown version you can send in via email. Thank you so much for joining us on this week's episode of your Unplug program, and we'll see you right back here next Tuesday, as in Sunday. I'm going to be able to be. You know,