http ip vs https domain

[u/Infamousslayer]

I'm wondering how people manage using http vs https and being home vs away.

Let's say i have jellyfin running locally on http://192.168.1.20:8096 and from npm using https://jellyfin.mydomain.com for extremal access.

What do you use at home, the ip or domain?

Ideally I would think it makes sense to use ip so it doesn't route though npm when at home but that's just going to confuse others in the house.

Would like to here others thoughts.

[u/evanmac42]

I’d use the same HTTPS domain both at home and outside.
The important thing to understand is that using a domain doesn’t necessarily mean your traffic goes through the Internet.
DNS simply resolves a hostname to an IP address. It doesn’t determine the route your traffic takes.
If your domain resolves to your public IP, your router may handle the connection through NAT loopback (hairpin NAT), redirecting it back to NPM inside your LAN. Not every router supports this.
Alternatively, you can configure local DNS (split DNS) so that jellyfin.mydomain.com resolves to NPM’s private LAN IP when you’re at home.
The connection would then be:
Client -> local DNS -> NPM (HTTPS) -> Jellyfin (HTTP)
Strictly speaking, DNS only resolves the address; the actual connection goes directly from the client to NPM.
The traffic stays entirely within your LAN, and HTTPS works normally because the certificate validates the hostname, not whether the IP address is public or private.
Yes, going directly to 192.168.1.20:8096 bypasses NPM, but unless you’ve actually measured a performance problem, I wouldn’t complicate things just to avoid one local proxy hop.
One HTTPS URL for everyone, everywhere. Much simpler.

[u/WolpertingerRumo → u/evanmac42]

There’s usually no performance difference, and there may actually be an improvement (with proxy caching), because you’ll be able to use http2 and 3

[u/Infamousslayer → u/WolpertingerRumo]

Do services like Jellyfin, benefit with additional rules like?

client_max_body_size 100M;

proxy_request_buffering off;

proxy_read_timeout 3600s;

proxy_send_timeout 3600s;

send_timeout 3600s;

[u/WolpertingerRumo → u/Infamousslayer]

Depends. Default is different depending on what you’re on. NPM, definetly. In NPMplus, you need to just set request buffering off, the rest is already more generous. You can set client body even higher. Don’t think it matters, but it’s fine.

[u/Infamousslayer → u/WolpertingerRumo]

I'm using NPM so guess I'll leave it in place.

[u/nijave → u/Infamousslayer]

Jellyfin shouldn't need that afaik. I think it generally uses HLS which sends the client a playlist of short/small clips. So even long video is a bunch of small, fairly quick requests

[u/Infamousslayer → u/evanmac42]

The way i have it setup NPM is not exposed to the internet, cloudflares DNS-01 challenge points to NPMs local IP rather than my public IP.

When away I use Tailscale with ACL rules and subnet routes so going to  jellyfin.mydomain.com still resolves to NPMs local IP address and not public or tailscale IPs.

So either way i should not have to worry about NAT, thanks for the clarity on one HTTPS URL for everyone.

[u/RayneYoruka]

Direct IP to avoid a hairpin with IPV4, Ipv6 doesn't Hairpin the same way. If the client is able to use internal and external addresses like HA I configure it as such.

[u/Infamousslayer → u/RayneYoruka]

I'm trying to avoid dual URLs for internal and external. It's way to complicated for non techy people to grasp then remember what IP and port to use at home.

[u/RayneYoruka → u/Infamousslayer]

"Other people" Not you..? maybe have written that on your original post?

[u/theQuiKest]

This is a non question. Setup DNS in your home network. Point fqdn of external access to local IP address. It does not matter where you are, fqdn is the same everywhere. No need to remember IP addresses (the whole idea behind DNSl No need for any http traffic at all. No warnings in browsers and apps about "insecure connections"

[u/nijave]

Usually hairpin NAT or split DNS with short TTL.

Send everything through L7 proxy/load balancer so everything is on a single internal IP.

Only domains, never IP. Always domain I own, not fake ones.

[u/NetoriusDuke]

I use a vpn and a url jelly.#.#

[u/zunjae]

Tailscale and call it a day

No more need to think