The user can just edit the wg conf file and remove the restriction where it can and cannot connect to.
The file is not a baked immutable binary

Or yours to own.

I’d say do it.
If the amount of episodes are daunting you:

• Skip the recap (1-4min)
• Skip intro (1-2min)
• Skip preciew (~1min)

This already saves you 3-7min on a 24min episode.

Remove filler/recap episodes and this will cut down the amount of episodes by the 50s to 100s.

Great…
I was wondering why no new releases and when new were coming.

Yes. Split-tunneling…
But if you are really hardcore about restrictions and would need to update the profiles it will be a pita…
Scheduling stuff is annoying ;-;

Agreed.
Secure it properly and you wont be pwned instantly.
My setup:
WAN -> OPNsense -> CrowdSec on FW and docker server -> Traefik -> Authelia middleware -> Jellyfin.

I also have a geoblock active on the Cloudflare domain and directly on my opnsense.
Most datacenter ASNs are also blocked. They don’t need to connect to me.

Yes, first party apps are broken but the browser works good enough and if I meed it, I have a VPN for myself.
Relatives get web browser or I’ll consider a S2S VPN setup.

Issue:
Most clients we instruct on homeoffice usage with vpns are already unable to remember the workflow: VPN -> (wait until green for connected) -> open work app -> Do work -> close work app -> disconnect vpn.

Now you also may not want to tunnel all traffic (if you don’t have a VPS with symmetric Gbit and unlimited traffic) so you’d need to set up split-tunneling and/or limit the apps allowed for the tunnel (works in android).

Honestly? It would be easier to set up a S2S split-tunnel VPN with wireguard on the relatives router.

Very cool. Thanks for the pictures!

How are you doing HA? Have you passed through the NIC or are you just doing a NIC bridge (or whatever networking proxmox offers)?

Very complicated problem to have?
I just back mine up via Veeam. The VM is running on proxmox.

20$ SSD…
That were the times man…

May I ask with what you initiate the connection?
Are you using some kind of STUN server/service?

The german router “FritzBox” recently did implement this.
A very rudimentary version of it but still.

No I mean why would the attacker even attempt to attack your outside if they can just figure out what sits behind it, follow it through the NAT and then exploit it from there.

Same energy:
https://youtu.be/Jpuqmjd12lg

Title: I Got My Own AS Number. Here’s: What It Took

I skimmed over your posted blog. Reads like a somewhat same process.

Literally “Same, same but different” ^^

  jellyfin:
    container_name: jellyfin
    image: linuxserver/jellyfin:amd64-version-12.1ubu2604
    expose:
      - 8096
    networks:
      - media
    volumes:
      - ${DIR_LOCALTIME}:/etc/localtime:ro
      - ${DIR_container}/jellyfin/config:/config
      - ${DIR_media}/data:/media/data
    devices:
      # IntelQuickSync für TigerLake GT2 [Iris Xe Graphics]
      - /dev/dri/renderD128:/dev/dri/renderD128
      - /dev/dri/card0:/dev/dri/card0
    environment:
      PUID: 1200
      PGID: 1300
      #UMASK: 022
      TZ: ${TZ}
      DOCKER_MODS: linuxserver/mods:jellyfin-opencl-intel
      JELLYFIN_PublishedServerUrl: "https://jellyfin/.$%7BDOMAIN_EXTERNAL%7D"
    deploy:
      resources:
        limits:
          memory: 10G
    group_add:
      - '44'
      - '992'
    labels:
      # Traefik:
      traefik.enable: true # Enable Traefik reverse proxy for the Traefik dashboard.
      traefik.http.services.jellyfin.loadbalancer.server.port: 8096
      traefik.http.routers.jellyfin-public.entrypoints: 'https'
      traefik.http.routers.jellyfin-public.rule: 'Host(`jellyfin.${DOMAIN_EXTERNAL}`)'
      # Secondary domain
      traefik.http.routers.jellyfin-public2.entrypoints: 'https'
      traefik.http.routers.jellyfin-public2.rule: 'Host(`jellyfin.${DOMAIN_EXTERNAL2}`)'
    restart: unless-stopped

Afaik the card0 is only used for rendering to a desktop/monitor and for this purpose you should actually use the renderD128 path.
But not sure either about this stuff. Sort of works for me. At least intel_gpu_top shows activity when transcoding :p

Why should they take over the outer router if they can just take over the destination they were routed to?

The indexer option is a thing in prowlarr?
If so, I havent seen it.

Bruh mate.
Mine changes daily so stop complaining that hard xD

Honest suggestion: Just set up a dyndns with any dns provider that supports automations.

I think this isnt a thing with prowlarr, is it?