Emby Server HTTPS (Reverse Proxy)
There are a number of ways to connect to your Emby server using HTTPS. This Follows on from Part 2: Cloudflare Setup.
Part 3A: Setting up Emby with NPM Docker Reverse Proxy (Advanced).
Part 3B: This Guide is for Direct Connection (Simple).
Part 3C: Setting up Emby with NGINX on Windows Reverse Proxy (Advanced).
This Guide is for setting up Emby behind a reverse proxy such as NGINX or Apache. For the purposes of this guide it will follow Installing and configuring NGINX on a Windows based machine.
Pre-Requisites
- Emby Server installed and running
- Your own Domain name
- A Trust certificate in either .crt or .pem format
- A Private.key to go with the certificate
- Access to your router for port forwarding
- Either a DDNS or have an A Record for WAN IP.
If you havent got a Trusted Certificate you can use my guide Easy Let's Encrypt Certificate to get a free one.
This guide assumes you have either setup a DDNS or have an A record setup to point your Domain Name to your WAN IP. If you dont have this setup go here.
Step 1 - Port Forwarding
Every router is different and rather than try to describe how to do this on all the different brands I will simplify it so it is more relevant to all routers.
- Log into your router
- Head over to port forwarding
- Create a new rule to forward port 443 and port 80 to the machine that NGINX will be running on.
Step 2 - Installing NGINX
Head over to NGINX-Win and download the latest version of NGINX for Windows. As of writing this guide the latest version is 1.13.1.1 Violet.
Extract the .zip folder somewhere easy to find. for my example I will extract it to C:\NGINX\ Open up the config folder C:\NGINX\config
Open up notepad (I recommend Notepad++) and copy the following into it.
Worker_processes 2;
events {
worker_connections 8192;
}
http {
include mime.types;
default_type application/octet-stream;
server_tokens off;
gzip on;
gzip_disable "msie6";
gzip_comp_level 6;
gzip_min_length 1100;
gzip_buffers 16 8k;
gzip_proxied any;
gzip_types
text/plain
text/css
text/js
text/xml
text/javascript
application/javascript
application/x-javascript
application/json
application/xml
application/rss+xml
image/svg+xml;
tcp_nodelay on;
sendfile off;
server_names_hash_bucket_size 128;
map_hash_bucket_size 64;
## Start: Timeouts ##
client_body_timeout 10;
client_header_timeout 10;
keepalive_timeout 30;
send_timeout 10;
keepalive_requests 10;
## End: Timeouts ##
This is some default code to let NGINX know what to do.
After the part above copy in this code
## Default Listening ##
server {
listen 80 default_server;
listen [::]:80 default_server;
server_name _;
return 301 https://$host$request_uri;
}
This part makes NGINX listen on port 80 and any traffic it receives on port 80 (HTTP) it redirects to port 443 (HTTPS). It forces the connection to use a secure connection.
The next part is to configure NGINX to forward the traffic it receives for Emby to the correct location. Copy the code below into the same notepad.
##EMBY Server##
server {
listen [::]:443 ssl http2;
listen 443 ssl http2;
server_name emby.mysite.com;
Anything with # in front of it means that its a note or a disabled configuration.
From the code above change emby.mysite.com to what ever your sub-domain name is.
Next we look at adding our beefed up security into the config.
ssl_session_timeout 30m;
ssl_protocols TLSv1.2 TLSv1.1 TLSv1;
ssl_certificate SSL/cert.pem;
ssl_certificate_key SSL/private.key;
ssl_session_cache shared:SSL:10m;
ssl_prefer_server_ciphers on;
ssl_ciphers ECDH+AESGCM:ECDH+AES256:ECDH+AES128:DH+3DES:!ADH:!AECDH:!MD5;
add_header X-Xss-Protection "1; mode=block" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Strict-Transport-Security "max-age=2592000; includeSubdomains" always;
add_header X-Frame-Options "SAMEORIGIN" always;
proxy_hide_header X-Powered-By;
add_header 'Referrer-Policy' 'no-referrer';
add_header Content-Security-Policy "frame-ancestors mysite.com emby.mysite.com;";
Without going into too much detail for this guide, the above section tells NGINX what encryption ciphers to use, the location of our certs and adds some extra security measures to the html headers.
So from the above we need to edit the following
ssl_certificate SSL/cert.pem;
ssl_certificate_key SSL/private.key;
This is the location of our cert.pem and private.key. I have them located in my NGINX folder in the following location C:\NGINX\config\SSL
To find out how to create the Certs please use the guide Easy Let's Encrypt Certificates At the bottom it describes how to create .pem certs.
Next part we need to change from the above is
add_header Content-Security-Policy "frame-ancestors mysite.com emby.mysite.com;";
Change mysite.com emby.mysite.com to your Domain names. Also you need to add in here ALL your other sub domains that NGINX will manage. for example mysite.com emby.mysite.com sonarr.mysite.com
The next block is the location block, add this to your notepad.
location / {
proxy_pass http://127.0.0.1:8096;
proxy_set_header Range $http_range;
proxy_set_header If-Range $http_if_range;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
}
}
}
The location block tells NGINX what to do when it received data and where to forward it to. It is also required for web sockets to work.
Edit the proxy_pass and point it to the location of your Emby Server. If it is running on the same machine as NGINX you can leave it as http://127.0.0.1:8096. If its running on another machine you will need to know the IP. http://192.168.1.10:8096 etc.
location / {
proxy_pass http://127.0.0.1:8096;
The whole config should now look like this.
worker_processes 2;
events {
worker_connections 8192;
}
http {
include mime.types;
default_type application/octet-stream;
server_tokens off;
gzip on;
gzip_disable "msie6";
gzip_comp_level 6;
gzip_min_length 1100;
gzip_buffers 16 8k;
gzip_proxied any;
gzip_types
text/plain
text/css
text/js
text/xml
text/javascript
application/javascript
application/x-javascript
application/json
application/xml
application/rss+xml
image/svg+xml;
tcp_nodelay on;
sendfile off;
server_names_hash_bucket_size 128;
map_hash_bucket_size 64;
## Start: Timeouts ##
client_body_timeout 10;
client_header_timeout 10;
keepalive_timeout 30;
send_timeout 10;
keepalive_requests 10;
## End: Timeouts ##
## Default Listening ##
server {
listen 80 default_server;
listen [::]:80 default_server;
server_name _;
return 301 https://$host$request_uri;
}
##EMBY Server##
server {
listen [::]:443 ssl http2;
listen 443 ssl http2;
server_name emby.mysite.com;
ssl_session_timeout 30m;
ssl_protocols TLSv1.2 TLSv1.1 TLSv1;
ssl_certificate SSL/cert.pem;
ssl_certificate_key SSL/private.key;
ssl_session_cache shared:SSL:10m;
ssl_prefer_server_ciphers on;
ssl_ciphers ECDH+AESGCM:ECDH+AES256:ECDH+AES128:DH+3DES:!ADH:!AECDH:!MD5;
add_header X-Xss-Protection "1; mode=block" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Strict-Transport-Security "max-age=2592000; includeSubdomains" always;
add_header X-Frame-Options "SAMEORIGIN" always;
proxy_hide_header X-Powered-By;
add_header 'Referrer-Policy' 'no-referrer';
add_header Content-Security-Policy "frame-ancestors mysite.com emby.mysite.com;";
location / {
proxy_pass http://127.0.0.1:8096;
proxy_set_header Range $http_range;
proxy_set_header If-Range $http_if_range;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
}
}
}
Save the notepad as nginx.config in the following location C:\NGINX\config
Step 3 - Set NGINX as a Windows Service
To get NGINX to start with Windows we need to donwload an application called NSSM (Non-sucking service manager). Download it and extract it. You will have a choice to use win32 or win64 version. Choice the version that relates to your Windows installation. Copy the nssm.exe to C:\Windows\System32
Open up a command prompt (Run as administrator) type the following
nssm install NGINX
It will now display this
Fill in the Path to the NGINX.exe and the Startup Directory as above.
Click ok
Open up Service.msc and find the NGINX Service we just installed.
Right click and Start.
To Test, we can navigate to emby.mysite.com and it should bring up your Emby Server!
If you have any problems drop a comment below. I will also be creating a Troubleshooting NGINX post soon.
