How to Set Up HTTPS and Remote Access for Jellyfin

The recommended setup: Caddy as a reverse proxy

1. Get a domain name pointing at your homeUse a domain you own and add an A record (for example media.example.com) pointing at your home's public IP address. If your IP changes, use a dynamic DNS service to keep the record current.
2. Forward ports 80 and 443 to the proxy machineIn your router, forward TCP ports 80 and 443 to the computer that will run the reverse proxy. Do not forward Jellyfin's own port 8096 — the proxy is the only thing the internet should reach.
3. Install Caddy and point it at JellyfinInstall Caddy on the same machine as Jellyfin and use a two-line Caddyfile that reverse-proxies your domain to localhost:8096. Caddy obtains and renews a Let's Encrypt certificate automatically.
4. Tell Jellyfin about the proxyIn Jellyfin, open Dashboard → Networking and add the proxy's IP address under Known proxies, then restart Jellyfin. This lets Jellyfin see each viewer's real address.
5. Test from outside your networkOn your phone, turn off Wi-Fi and open https://media.example.com. If the Jellyfin sign-in page loads with a padlock, the server is ready for iPhone, iPad and Apple TV apps.

Your whole Caddyfile:

media.example.com {
	reverse_proxy localhost:8096
}

Reload Caddy (sudo systemctl reload caddy on Linux) and it fetches the certificate on the first request. The domain must already resolve to your IP and ports 80 and 443 must be forwarded, or the certificate request fails.

Alternative: nginx with Let's Encrypt

If you already run nginx, request a certificate with Certbot (sudo certbot certonly --nginx -d media.example.com) and add a server block like this. The /socket location keeps Jellyfin's live updates working through the proxy.

server {
    listen 443 ssl;
    http2 on;
    server_name media.example.com;

    ssl_certificate     /etc/letsencrypt/live/media.example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/media.example.com/privkey.pem;

    location / {
        proxy_pass http://127.0.0.1:8096;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-Host $http_host;
        proxy_buffering off;
    }

    location /socket {
        proxy_pass http://127.0.0.1:8096;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
    }
}

Alternative: Tailscale, with no open ports

Tailscale Serve gives Jellyfin a trusted HTTPS address such as https://jellyfin.your-tailnet.ts.net, reachable only by devices signed in to your Tailscale network. Enable HTTPS certificates in the Tailscale admin console, then run tailscale serve --bg 8096 on the Jellyfin machine. It is private and easy, but every device that watches — including each Apple TV — must run Tailscale and be part of your network.

Tailscale Funnel (tailscale funnel --bg 8096) publishes the same address to the whole internet without port forwarding, so household devices need nothing extra. Check Tailscale's current Funnel limits before relying on it for video.

Keep it secure

• Give every Jellyfin account a strong, unique password, and disable any you do not use.
• Keep Jellyfin and your proxy updated.
• Share the server through an app that does not need everyone's Jellyfin password. With Media Center you connect Jellyfin once and invite your household by email — see sharing your server with family.

Once your HTTPS address works, connect it to Apple TV or your iPhone, and share it with friends and family. Running Plex too? The same proxy works for it — see Plex reverse proxy setup.