Media Server (Jellyfin)
LiveSignature capability
A full self-hosted streaming stack I run on a repurposed MacBook, fronted by a Google OAuth gate so only approved emails get in, with hardware transcoding and a public request portal.
What it is
It runs Jellyfin and the full arr automation stack in Docker on my Linux mbp-server. A request goes from the browser to a Hostinger k3s Traefik entrypoint over TLS, across Tailscale, through an oauth2-proxy that only lets approved Google emails past, and into Jellyfin. Intel VAAPI hardware transcoding handles x265/HEVC playback right in the browser. There's a separate public request portal where someone signs in with Google, asks for a film, and the arr stack finds and adds it on its own.
Highlights
- A Google OAuth gate (oauth2-proxy) in front of Jellyfin, locked to an allow-list of emails, so it's private without needing a VPN client.
- Runs on a repurposed 2017 MacBook Pro as a Linux Docker host, not cloud hardware.
- Intel VAAPI hardware transcoding for smooth x265/HEVC and EAC3 playback in the browser.
- Traffic routes browser to Hostinger k3s Traefik (TLS) to Tailscale to the server, so nothing is exposed directly to the internet.
- A public request portal (Jellyseerr behind Google auth) lets approved people request films the arr stack fetches automatically.
- One Google sign-in across both the watch and request portals via the Jellyfin SSO plugin.
Tech · Jellyfin, Radarr / Sonarr / Prowlarr, qBittorrent, NordVPN, Docker, oauth2-proxy (Google OIDC), Traefik on k3s, Tailscale, VAAPI hardware transcode, Jellyseerr.