I recently generated a self-signed cert to use with NGINX via it’s GUI.

  1. Generate cert and key
  2. Upload these via the GUI
  3. Apply to each Proxy Host

Now when I visit my internal sites (eg, jellyfin.home) I get a warning (because this cert is not signed by a trusted CA) but the connection is https.

My question is, does this mean that my connection is fully encrypted from my client (eg my laptop) to my server hosting Jellyfin? I understand that when I go to jellyfin.home, my PiHole resolves this to NGINX, then NGINX completes the connection to the IP:port it has configured and uses the cert it has assigned to this proxy host, but the Jellyfin server itself does not have any certs installed on it.

  • catloaf@lemm.eeEnglish
    2·
    5 days ago

    If jellyfin isn’t configured for https, then the proxy is terminating the encryption and it proceeds unencrypted. If it’s purely internal routing that’s fine, but if not then additional configuration is required.

    But if it’s all on the LAN, it’s probably not a big deal in any case.

    • root@lemmy.worldOP
      1·
      5 days ago

      Gotcha, that matches my assumptions. Yes everything is internal. It’s accessible remotely via Wireguard, but I mostly wanted to get some practice with NGINX/ TLS certs (also way easier to refer to things around the house with <service>.homelab isntead of IP:port, haha.

      So if I did want this to be fully encrypted, I would essentially need to configure each service (jellyfin, home assistant, etc) to have SSL on them with this self-signed cert/ key that I used on NGINX (or perhaps new cert/ key) and then I would be all set?

      • catloaf@lemm.eeEnglish
        1·
        5 days ago

        Yes. Or, just don’t expose jellyfin to the LAN and be okay with traffic being unencrypted on the LAN. Personally I use traefik and jellyfin as containers on one host, so that traffic never transits any Ethernet.