Emby behind nginx reverse proxy with auth

[flower1024 1]

Hello, 

 

I use emby behind a reverse https proxy with nginx authentication. The web interface works great.

But the android and androidtv app doesnt. 

I need auth because i want emby to work from remote locations. 

Is there any way to do this? 

I have a subscription if this changes anything. 

Regards

[mastrmind11 722]

yep, plenty of posts about it on these forums and on google.  its a pretty common setup.

[OmgOmgHax 0]

I don't know if my issue is the same, but I also try to access Emby with NGINX from outside my network, and it seems to be working, but for some reason all the users i try to log in get the "wrong password entered". 

[flower1024 1]

My only problem is http auth inside nginx with an android app. 

I am not talking about emby authentication. Nginx aith is before that. 

Everything else works. 

 

[Q-Droid 989]

7 hours ago, flower1024 said:

My only problem is http auth inside nginx with an android app. 

I am not talking about emby authentication. Nginx aith is before that. 

Everything else works. 

 

If you're using nginx auth because you have other resources behind it in addition to Emby then it will be a problem for apps. You config requires double auth? Once for nginx (portal?) and again for Emby? For this to work with apps you might have to allow connections to the Emby resource thru without auth but maintain it for others.

But if Emby is the only service you need to access behind nginx then turn off auth and let Emby do its own. Just make sure the nginx config correctly identifies remote connections so that the Emby server is aware and presents the login page.

 

[flower1024 1]

I can distinguish between apps thourhg fqdn. 

Is embys auth good enough? I just don't feel good with putting emby directly in the internet..

Nginx with "double auth" just gives me confidence as nginx is battle proofen and designed for this

[Q-Droid 989]

The nginx reverse proxy and other general security features would remain in place even when Emby handles the auth. I don't know how secure or not the Emby auth is, I allow it and so do many others. But ultimately it's up to you. I wouldn't expect the apps to ever work if you have nginx auth in front of Emby.

 

[mastrmind11 722]

i you're worried about hacks, you can add fail2ban to your stack and just ban the IP after x number or bad logins for y amount of time.  Plenty of topics of that on here too, including 1 mega topic.  You can also add Cloudflare in front of everything if you want a CDN to handle connections and avoid DDOS.  If you're scared about some bad actor hacking your admin account and deleting your media (worst case), then just hide your admin account from the login page.  Then, the worst case that can happen is some hacker gets to stream Little Mermaid from your server for an afternoon (assuming you don't give your other users delete access).

[flower1024 1]

i think i will just forbid external access and use wireguard as vpn. its only my android devices and my fiancee notebook so this is easy to do.

thank you all for your input.

[gokuz 13]

On 2/16/2021 at 4:10 AM, flower1024 said:

i think i will just forbid external access and use wireguard as vpn. its only my android devices and my fiancee notebook so this is easy to do.

thank you all for your input.

2fa will solve your problem. I'm still waiting for emby to release 2FA support. Plex already has it. No excuses now emby devs, cmon.

[Charlo 0]

Any update on 2fa in Emby?