admin
e5a59848f1
gates / gates (push) Successful in 5s
Jellyfin: KnownProxies 172.16.0.0/12 seeded into network.xml. Emby: LocalNetworkSubnets 10.0.0.0/8 + 192.168.0.0/16 seeded into system.xml. Fresh volume or empty list only. Measured on 9202 through the simulated tunnel: remote-off user 200 -> 403; LAN household still 200. Held on night-held-2026-10-06 (night fence); not for main tonight. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
81 lines
3.9 KiB
YAML
81 lines
3.9 KiB
YAML
# Emby - Személyes média szerver élő TV és DVR támogatással
|
|
# Domain: ${SUBDOMAIN}.${DOMAIN}
|
|
# Database: None (file-based)
|
|
# RAM: ~512M (mem_limit: 2048M) | Pi-compatible: No
|
|
#
|
|
# Environment variables:
|
|
# DOMAIN - Your domain (e.g., demo-felhom.eu)
|
|
# USERDATA_PATH - Ügyfél-tartalom gyökér (<namespace>/userdata)
|
|
#
|
|
# Storage layout (felhom userdata convention):
|
|
# Médiatár → ${USERDATA_PATH}/media (csak olvasható)
|
|
|
|
services:
|
|
emby:
|
|
image: emby/embyserver:4.11.0.4
|
|
container_name: emby
|
|
restart: unless-stopped
|
|
# R-777: Emby decides "local network" from the visitor's address (remote access per user, the IP filter, the
|
|
# forgot-password PIN). Behind the tunnel it sees cloudflared's 172.16.253.2, and with LocalNetworkSubnets empty
|
|
# every private address counts as local — so EVERY internet visitor was local (measured on 9202 2026-10-06: a
|
|
# user with remote access OFF signed in through the tunnel, session address 172.16.253.2). Naming the home
|
|
# ranges 10.0.0.0/8 and 192.168.0.0/16 (NOT 172.16.0.0/12, where traefik and cloudflared live) makes the tunnel
|
|
# remote and keeps a LAN visitor local (measured: tunnel 403, LAN 200). A home network in 172.16-31.x then counts
|
|
# as remote — the safe direction. Written in system.xml before the server starts, on a fresh volume or while the
|
|
# list is still empty (a household's own list is left alone); owned by the server's user.
|
|
entrypoint:
|
|
- /bin/sh
|
|
- -c
|
|
- |
|
|
f=/config/config/system.xml
|
|
if [ ! -f "$$f" ]; then
|
|
mkdir -p /config/config
|
|
printf '%s\n' '<?xml version="1.0"?>' '<ServerConfiguration xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">' ' <LocalNetworkSubnets>' ' <string>10.0.0.0/8</string>' ' <string>192.168.0.0/16</string>' ' </LocalNetworkSubnets>' '</ServerConfiguration>' > "$$f"
|
|
chown "$${UID:-1000}:$${GID:-1000}" /config /config/config "$$f"
|
|
echo "[felhom] system.xml seeded: LocalNetworkSubnets 10.0.0.0/8, 192.168.0.0/16 (R-777)"
|
|
elif grep -q '<LocalNetworkSubnets />' "$$f"; then
|
|
sed -i 's#<LocalNetworkSubnets />#<LocalNetworkSubnets><string>10.0.0.0/8</string><string>192.168.0.0/16</string></LocalNetworkSubnets>#' "$$f"
|
|
echo "[felhom] system.xml: LocalNetworkSubnets was empty, set to 10.0.0.0/8, 192.168.0.0/16 (R-777)"
|
|
fi
|
|
exec /init
|
|
environment:
|
|
- TZ=Europe/Budapest
|
|
- UID=1000
|
|
- GID=1000
|
|
volumes:
|
|
- emby_config:/config
|
|
- ${USERDATA_PATH}/media:/media:ro
|
|
networks:
|
|
- traefik-public
|
|
deploy:
|
|
resources:
|
|
limits:
|
|
memory: 2048M
|
|
healthcheck:
|
|
# Az Emby képfájlban NINCS curl és nincs önálló wget — csak BusyBox van.
|
|
# A korábbi curl-próba ezért soha nem futott le, a konténer véglegesen
|
|
# unhealthy maradt, és a Traefik nem irányított rá forgalmat (404).
|
|
test: ["CMD", "/bin/busybox", "wget", "--spider", "-q", "http://127.0.0.1:8096/emby/system/ping"]
|
|
interval: 30s
|
|
timeout: 5s
|
|
retries: 3
|
|
start_period: 30s
|
|
labels:
|
|
- "traefik.enable=true"
|
|
- "traefik.http.routers.emby.rule=Host(`${SUBDOMAIN}.${DOMAIN}`)"
|
|
# R-753: this app reads the LEFTMOST X-Forwarded-For entry, which a stranger writes once traefik keeps the
|
|
# tunnel's chain — so its chain is removed here (it then reads traefik's X-Real-Ip or peer; never forgeable).
|
|
- "traefik.http.middlewares.emby-xff.headers.customrequestheaders.X-Forwarded-For="
|
|
- "traefik.http.routers.emby.middlewares=emby-xff"
|
|
- "traefik.http.routers.emby.entrypoints=websecure"
|
|
- "traefik.http.routers.emby.tls=true"
|
|
- "traefik.http.routers.emby.tls.certresolver=letsencrypt"
|
|
- "traefik.http.services.emby.loadbalancer.server.port=8096"
|
|
|
|
volumes:
|
|
emby_config:
|
|
|
|
networks:
|
|
traefik-public:
|
|
external: true
|