Guide
Keep household services behind loopback, a private network or a VPN. Private access still needs application authentication, safe initialization and backups.
An SSH tunnel or VPN limits who can reach a service. It does not make every device on that network trustworthy, create an administrator safely, or change a shared dashboard into per-user access. Complete setup on loopback and keep the application’s own passwords and permissions where available.
The default loopback port is reachable from the server itself, not automatically from another machine on the LAN or VPN. For a remote server an SSH tunnel is often enough. A private reverse proxy can provide HTTPS and the correct browser origin without an internet port forward. Preserve Host, allowed-host and external-URL settings where the recipe requires them.
Local access does not mean every integration is offline. Podcast downloads, metadata lookup, push delivery, relay discovery or model downloads may use external services. Test the intended client and workflow rather than treating a reachable web page as proof of every feature. Keep off-server backups and verify recovery independently of network isolation.
Sets
The sum of the minimums the recipes below declare. It is a floor, not a recommendation: leave room for the operating system, backups and growth.
Why it is here: A resolver is the clearest case of all: it exists to answer devices on your own network, and a DNS server reachable from the internet is an open resolver someone will use for amplification attacks.
Why it is here: Keep synchronization peers on trusted networks or suitable private connectivity. Review discovery and relay settings separately; storing a replica does not replace independent backup.
Why it is here: A music library on the local network needs no certificate and no domain, and the mobile clients keep working over a VPN when you are away.
Why it is here: Local playback is the case Jellyfin is best at. Publishing it means a domain, a certificate and an authentication story — a VPN gives you the same result with none of them.
Why it is here: The one service on this list that has to keep working when the internet does not. Local control is the point, and the recipe is written for exactly that.
Why it is here: Phone upload happens over the network you are on most nights anyway. Keeping the library private means a VPN when you travel, and it removes the largest piece of attack surface in the catalog.
Why it is here: A shared local start page with recipe password protection. Configure the allowed Host/browser address correctly and treat integration keys as private data.
Why it is here: A private audio library with ordinary listener accounts. Run bootstrap before exposing setup even to an untrusted LAN, and use restored database credentials after recovery.
Why it is here: Household recipes can stay reachable only at home or through a VPN. Preserve uploads with the database and review user permissions and registration settings.
Why it is here: A static utility page without native login. Restrict access at the network or gateway if you need privacy; browser storage is not included in server backups.