Description
Please add an option to restrict selected Seerr users, particularly owner and administrator accounts, to local-network sign-in only.
My Seerr instance is publicly available behind a trusted reverse proxy so ordinary Jellyfin users can request media remotely. However, I want the Seerr owner and administrator accounts to be usable only through my LAN or Tailscale network.
At present, Jellyfin's per-user remote-access restriction does not solve this. Seerr authenticates with Jellyfin from the Seerr server, so Jellyfin sees the Seerr container's internal address rather than the original browser address. Consequently, an administrator whose Jellyfin account disallows remote access may still authenticate through a publicly accessible Seerr instance because the backend authentication request appears local.
Desired behavior
Add one or both of the following:
A per-user setting named Allow remote sign-in
A global setting named Restrict administrator sign-in to local networks
The administrator should be able to configure trusted networks, for example:
192.168.0.0/16
10.0.0.0/8
100.64.0.0/10 for Tailscale
When a restricted user attempts to sign in from outside those networks, Seerr should reject the login even when the supplied credentials are correct.
Seerr should use the original client address supplied by a trusted reverse proxy when proxy support is enabled.
Example setup
Public users access Seerr through https://jellyseerr.example.com
Caddy is configured as the trusted reverse proxy
Ordinary imported Jellyfin users may sign in remotely
The Seerr owner and administrator accounts may sign in only through LAN or Tailscale
Security benefit
This separates public media-request access from administrative access. A leaked administrator password would not be sufficient for remote sign-in, while normal users would retain easy access through standard Seerr clients and browsers.
Alternatives considered
Blocking all local authentication at the reverse proxy also blocks legitimate local administration through the same hostname.
Using Jellyfin's remote-access policy is ineffective because Jellyfin sees the server-side Seerr connection rather than the browser's original network location.
Requiring Tailscale for all users reduces accessibility unnecessarily.
Additional context
This would provide functionality similar to Jellyfin's per-user remote-access restriction, but enforced directly by Seerr based on the original client address.
Desired Behavior
Per user seperation for remote and local access so people that access via a reverse proxy like caddy, can't login to the admin account.
Additional Context
No response
Search Existing Issues
Code of Conduct
Description
Please add an option to restrict selected Seerr users, particularly owner and administrator accounts, to local-network sign-in only.
My Seerr instance is publicly available behind a trusted reverse proxy so ordinary Jellyfin users can request media remotely. However, I want the Seerr owner and administrator accounts to be usable only through my LAN or Tailscale network.
At present, Jellyfin's per-user remote-access restriction does not solve this. Seerr authenticates with Jellyfin from the Seerr server, so Jellyfin sees the Seerr container's internal address rather than the original browser address. Consequently, an administrator whose Jellyfin account disallows remote access may still authenticate through a publicly accessible Seerr instance because the backend authentication request appears local.
Desired behavior
Add one or both of the following:
A per-user setting named Allow remote sign-in
A global setting named Restrict administrator sign-in to local networks
The administrator should be able to configure trusted networks, for example:
192.168.0.0/16
10.0.0.0/8
100.64.0.0/10 for Tailscale
When a restricted user attempts to sign in from outside those networks, Seerr should reject the login even when the supplied credentials are correct.
Seerr should use the original client address supplied by a trusted reverse proxy when proxy support is enabled.
Example setup
Public users access Seerr through https://jellyseerr.example.com
Caddy is configured as the trusted reverse proxy
Ordinary imported Jellyfin users may sign in remotely
The Seerr owner and administrator accounts may sign in only through LAN or Tailscale
Security benefit
This separates public media-request access from administrative access. A leaked administrator password would not be sufficient for remote sign-in, while normal users would retain easy access through standard Seerr clients and browsers.
Alternatives considered
Blocking all local authentication at the reverse proxy also blocks legitimate local administration through the same hostname.
Using Jellyfin's remote-access policy is ineffective because Jellyfin sees the server-side Seerr connection rather than the browser's original network location.
Requiring Tailscale for all users reduces accessibility unnecessarily.
Additional context
This would provide functionality similar to Jellyfin's per-user remote-access restriction, but enforced directly by Seerr based on the original client address.
Desired Behavior
Per user seperation for remote and local access so people that access via a reverse proxy like caddy, can't login to the admin account.
Additional Context
No response
Search Existing Issues
Code of Conduct