

Ahhh interesting video! I appreciate the post. I see the mTLS is more about authenticating who the client is outside the application.
Don’t worry, Im not just exposing thing willy nilly 🤣 For client-side authentication I use Authentik combined with 2FA, Duo, and fail2ban. Authentik provides identity management through LDAP to jellyfin and any sign in request goes to MFA and you get a Duo notification to approve. You can do other MFA, i just havent set it up.
Ive got a lot of family who use my server. Asking them to install a TSL cert on every machine would be impossible. My method also monitors all sign in requests. Setting up Authentik was a hugggeee game changer for me.
Im at the compose2nix phase of this pipeline. Ive got a bunch or sevices in Docker compose files and all of my systems have been running Nix for over a year now. Ive gotten the hang of my repo and made a couple modules for my specific uses and im hooked.
What would you suggest to migrate all my compose files into a nix friendly environment? I use flakes as well.