Menu
ContentsRemote access

  1. Getting started

    1. What Kryspal Media is
    2. System requirements
    3. Install with Docker
    4. First-time setup
    5. Upgrade and back up

  2. Libraries

    1. Create and manage libraries
    2. File and folder naming
    3. Flexible file layout
    4. Metadata and NFO
    5. Tags
    6. Images
    7. strm and cloud drives
    8. StrmTool settings
    9. Subtitles
    10. Intro and outro
    11. Search tips
    12. Actors and people
    13. Duplicate videos

  3. Playback

    1. Web player
    2. Third-party players
    3. Remote access

  4. Members and devices

    1. Members
    2. Parental controls
    3. Devices and simultaneous streams

  5. Plugins

    1. Plugin center
    2. Plugins
    3. Third-party plugins

  6. Move from another server

    1. Move from Emby
    2. Move from Jellyfin

  7. Licenses and plans

    1. Compare plans
    2. PRO features in detail
    3. MAX features in detail
    4. Buy, activate and move a license
    5. Offline grace and expiry

  8. Troubleshooting

    1. Logs and reporting a problem

Remote access

Kryspal Media does not relay your traffic and does not terminate HTTPS. To watch away from home, you make the server reachable yourself. This page shows the two usual ways, the settings that matter, and a minimal example for Caddy, Nginx and Nginx Proxy Manager.

On this page
  1. Pick a way
  2. Settings that matter
  3. Minimal examples
  4. Caddy
  5. Nginx
  6. Nginx Proxy Manager
  7. Check it works
  8. If something fails

Pick a way#

  • A VPN such as Tailscale. Install it on the server's machine and on your devices, then use the server's VPN address with port 5797. Nothing is exposed to the internet. This is the simplest and safest choice.
  • A reverse proxy with HTTPS. The proxy listens on 443, holds the certificate and passes requests to the server. Use this when you want a normal web address that works in any player.

Whichever you choose, do not forward port 5797 on your router. It speaks plain HTTP. If you forward a port, forward only the outside-access port, 5798, and put the proxy in front of it.

Settings that matter#

Ports. The compose file already publishes 5797 (your local network) and 5798 (outside), and sets EXTERNAL_HTTP_ADDR: ":5798". Both ports serve the same server, including the admin console. The difference is how a connection is counted: anything that arrives on 5798 counts as outside your network. Point your proxy at 5798.

Trusted proxies. Add the proxy's address to the server so it can see who is really connecting. In the compose file, under the server's environment:

environment:
  EXTERNAL_HTTP_ADDR: ":5798"
  TRUSTED_PROXIES: "192.168.1.5"

The value is a comma-separated list of addresses or networks (for example 172.18.0.0/16 for a Docker network). The server will not start if an item is not valid. Without it, every request seems to come from the proxy, so sign-in attempt limits count all your viewers as one client, and if the proxy sits on a private address, people outside can be treated as being on your local network.

Public access URL. In System settings → Network, enter the address your players use from outside, for example https://media.example.com:8443. A path is allowed (https://example.com/media). It must be a full http:// or https:// address, without a user name, query or fragment; a trailing slash is removed. When it is set, the server uses it whenever it gives an outside connection a full address: the playback links handed to external players, copied play addresses and playlists, and the server address that Emby- and Jellyfin-style players are told. Connections from your local network keep using the local address. It saves you from depending on the proxy's headers, and it matters most when you use a port other than 443, because many proxies drop the port from Host. Set it, even if the proxy also sends the headers below.

Headers the proxy must send.

  • Host as the visitor typed it. Changes made from the web (saving settings and so on) are refused with a 403 if the Origin and Host differ.
  • X-Forwarded-Host and X-Forwarded-Proto. The server uses them to build the stream addresses it gives to external players such as Infuse when no public access URL is set. Without both, players get an internal address like http://server:5797/... that cannot be reached from outside.

WebSocket. Players keep a WebSocket open. The proxy must pass the Upgrade and Connection headers, and its read timeout must be at least 60 seconds (the server pings every 30).

Streaming and large files. Do not buffer or cache responses, and allow Range requests so players can seek. Set long read and send timeouts, so a long film is not cut off. The server already asks Nginx-family proxies not to buffer. If you upload artwork in the admin console, the proxy must accept bodies of at least 20 MiB (Nginx's default of 1 MiB does not).

HTTPS. The proxy holds the certificate. When the server sees X-Forwarded-Proto: https, it marks its sign-in cookie as secure automatically.

Treating your VPN as local. Devices that connect over a VPN are counted as outside by default. To count a VPN range as your local network, add LAN_RANGES with that range, for example LAN_RANGES: "100.64.0.0/10" for Tailscale.

Minimal examples#

Replace media.example.com with your own name and 192.168.1.10 with the server's address.

Caddy#

Caddy sends Host, X-Forwarded-Host and X-Forwarded-Proto by itself, passes WebSocket, does not buffer streams and gets the certificate automatically.

media.example.com {
    reverse_proxy 192.168.1.10:5798
}

Nginx#

map $http_upgrade $connection_upgrade {
    default upgrade;
    ''      close;
}

server {
    listen 443 ssl;
    server_name media.example.com;
    ssl_certificate     /etc/ssl/media.example.com.pem;
    ssl_certificate_key /etc/ssl/media.example.com.key;
    client_max_body_size 50m;

    location / {
        proxy_pass http://192.168.1.10:5798;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-Host $host;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
        proxy_buffering off;
        proxy_read_timeout 3600s;
        proxy_send_timeout 3600s;
    }
}

Nginx Proxy Manager#

  1. Proxy Hosts → Add Proxy Host. Domain name media.example.com, scheme http, forward host 192.168.1.10, port 5798. Turn on Websockets Support.
  2. SSL tab: request a certificate, turn on Force SSL.
  3. Advanced tab, custom configuration:
proxy_buffering off;
proxy_read_timeout 3600s;
proxy_send_timeout 3600s;
client_max_body_size 50m;

NPM sends the forwarded headers itself. Use the address of the NPM container or machine for TRUSTED_PROXIES.

Check it works#

  1. Open https://media.example.com from outside your network and sign in.
  2. Play a file in the web player, then add the same address (port 443) to your player; if you set the public access URL, check that the playback links use it.

If something fails#

  • Saving in the admin console fails with a 403. The proxy changes the Host header. Pass it through unchanged.
  • Players are given an address that does not work. The proxy is not sending X-Forwarded-Host and X-Forwarded-Proto.
  • Everything counts as local network, or one failed sign-in locks out others. Add the proxy to TRUSTED_PROXIES.
  • Playback stops after some minutes, or the live view does not update. Raise the proxy's read timeout and turn buffering off.

The admin console is reachable through the same address. Use a strong administrator password, or limit access to the console at the proxy if you do not need it from outside. For more on logs and what to include in a report, see Logs and reporting problems.