Probably the majority of people with a Plex Pass subscription and most Plex users in general.
As far as I see it, Plex's primary purpose is to allow people who have extensive collections of legally obtained digital media to conveniently access it and share access to their friends and family on pretty much any random device from anywhere in the world.
All my home media devices run Kodi, they run Jellyfin, they run all sorts of fully open stuff, but when I travel Plex wins because it runs on basically anything that can stream video and I can sign in to it in seconds without needing to connect a VPN or enter my password on someone else's device.
It's less convenient to use and pretty much impossible to share with others. I can figure out a VPN on all my devices for the most part (except for a Boox ereader). Trying to get "family and friends" to install and maintain a VPN on their devices to be able to access services I share with them is a pipe dream.
Additionally, if they try to connect from an Android TV / Fire Stick, where you can't configure a VPN (and use their ISP's modem, so no wireguard client on the router to transparently route to the subnet), what are you supposed to do?
I feel it may be easier long-term to just contain the Jellyfin daemon to only r/o access to media, putting it behind a subdomain like jellyfin.example.com, and use the dns-01 challenge via LE to only provision a wildcard cert for the domain (IE *.example.com).
Then, have nginx listen on 80/443 with a default server directive that returns 444 for any requests not to the (correct) jellyfin hostname (due to bots hammering 80/443 across the internet on webserver's direct IPs).
Its the only solution I can think of to make it easy for nontechnical users (everything just described is completely invisible to a regular client) while reducing the attack surface area of the daemon.
FWIW, with the aforementioned setup, I got 0 unauthorized requests to my jellyfin server. Just a bunch of bots hammering my IP's 80/443 ports directly with exploits for old (usually wordpress) vulns, but they were all served 444 (IE an immediate TCP connection close without nginx even responding to the request).
"Install this app on your Apple TV or Android TV, login with your Gmail, and let me know your email address."
Also of course friends/family. The most technologically useless people I know can operate Plex and can access my collection with basically no support necessary.
If it were just me using Plex then it would be different, but I can't realistically expect all my friends and family to get on a tailnet, and so I take the risk with an up-to-date Plex on the internet.
The point of Plex is sharing your library with less ... technical users.
If I didn't want to do that, I'd not even use Jellyfin- SMB share and mpv would be fine with me.
I run jellyfin on the open internet through caddy. I've done a few things to the configuration to secure it, like user-agent restrictions and fail2ban for login failures, and excessive 400 series errors. I keep it up to date.
History- I started it last year the night before my birthday so I guess it's kinda like a midlife crisis. I've been working on it relentlessly since and kind of want a real job at this point just so I can take PTO.
testflite@pixelbrite.site if interested
I think the current version of Docker engine Synology uses was end-of-life 2.5 years ago.
A budy of mine has got 30 000 movies and series. Better offer than Netflix (what, easily 4x more choice!?). He's got a 42U rack. He gives free access to his server to his friends and family: it's not a business (so what he risks is also very limited in the country he lives in, for he's not making a business out of it).
It's not because you and I don't run Plex servers accessible from the big bad Internet that others don't enjoy doing it.
Now concerning this miner: I've posted about it in the past here on HN but I only run Jellyfin on my LAN and it's only with throwaway containers: I've got a script that sets up movies/series named/organized the way Jellyfin likes it, then that volume is passed read-only to a transient podman container.
When we're done watching the movie, the podman container is deleted. It's over: it doesn't exists anymore.
All that I care about are data: like family pictures and movies (and, say, other movies).
My Jellyfin server is just a temporary "view" on my actual data.
I don't trust it and don't need to trust it: for it's only future after I'm done watching the movie is to be destroyed.
And how did you set up the trigger to automatically spin up the ephemeral jellyfin container when a movie is selected?
Thanks!