Emby Server HTTPS (Reverse Proxy)

enter image description here

There are 2 ways to connect to your Emby server using HTTPS.

This Guide is for setting up Emby behind a reverse proxy such as NGINX or Apache. For the purposes of this guide it will follow Installing and configuring NGINX on a Windows based machine.

For a basic HTTPS connection to Emby please see the Direct Connection (Simple) Guide 'HERE'.

Pre-Requisites

  • Emby Server installed and running
  • Your own Domain name
  • A Trust certificate in either .crt or .pem format
  • A Private.key to go with the certificate
  • Access to your router for port forwarding
  • Either a DDNS or have an A Record for WAN IP.

If you havent got a Trusted Certificate you can use my guide Easy Let's Encrypt Certificate to get a free one.

This guide assumes you have either setup a DDNS or have an A record setup to point your Domain Name to your WAN IP. If you dont have this setup go here.

Step 1 - Port Forwarding

Every router is different and rather than try to describe how to do this on all the different brands I will simplify it so it is more relevant to all routers.

  • Log into your router
  • Head over to port forwarding
  • Create a new rule to forward port 443 and port 80 to the machine that NGINX will be running on.

Step 2 - Installing NGINX

Head over to NGINX-Win and download the latest version of NGINX for Windows. As of writing this guide the latest version is 1.13.1.1 Violet.

NGINX

Extract the .zip folder somewhere easy to find. for my example I will extract it to C:\NGINX\ Open up the config folder C:\NGINX\configNGINX Open up notepad (I recommend Notepad++) and copy the following into it.

Worker_processes  2;

events {
    worker_connections  8192;
}

http {
    include       mime.types;
    default_type  application/octet-stream;
    server_tokens off;

    gzip on;
    gzip_disable "msie6";
    gzip_comp_level 6;
    gzip_min_length 1100;
    gzip_buffers 16 8k;
    gzip_proxied any;
    gzip_types
        text/plain
        text/css
        text/js
        text/xml
        text/javascript
        application/javascript
        application/x-javascript
        application/json
        application/xml
        application/rss+xml
        image/svg+xml;

         tcp_nodelay on;

    sendfile        off;

    server_names_hash_bucket_size 128;
    map_hash_bucket_size 64;

## Start: Timeouts ##
    client_body_timeout   10;
    client_header_timeout 10;
    keepalive_timeout     30;
    send_timeout          10;
    keepalive_requests    10;
 ## End: Timeouts ##

This is some default code to let NGINX know what to do.

After the part above copy in this code

## Default Listening ##

server {
    listen 80 default_server;
    listen [::]:80 default_server;
    server_name _;
 return 301 https://$host$request_uri;
}

This part makes NGINX listen on port 80 and any traffic it receives on port 80 (HTTP) it redirects to port 443 (HTTPS). It forces the connection to use a secure connection.

The next part is to configure NGINX to forward the traffic it receives for Emby to the correct location. Copy the code below into the same notepad.

##EMBY Server##

    server {
    listen [::]:443 ssl http2;
    listen 443 ssl http2;
    server_name emby.mysite.com; 

Anything with # in front of it means that its a note or a disabled configuration.

From the code above change emby.mysite.com to what ever your sub-domain name is.

Next we look at adding our beefed up security into the config.

        ssl_session_timeout 30m;
        ssl_protocols TLSv1.2 TLSv1.1 TLSv1;
        ssl_certificate      SSL/cert.pem;
        ssl_certificate_key  SSL/private.key;
        ssl_session_cache shared:SSL:10m;
        ssl_prefer_server_ciphers on;
        ssl_ciphers ECDH+AESGCM:ECDH+AES256:ECDH+AES128:DH+3DES:!ADH:!AECDH:!MD5;


        add_header X-Xss-Protection "1; mode=block" always;
        add_header X-Content-Type-Options "nosniff" always;
        add_header Strict-Transport-Security "max-age=2592000; includeSubdomains" always;
        add_header X-Frame-Options "SAMEORIGIN" always;
        proxy_hide_header X-Powered-By;
        add_header 'Referrer-Policy' 'no-referrer';
        add_header Content-Security-Policy "frame-ancestors mysite.com emby.mysite.com;";

Without going into too much detail for this guide, the above section tells NGINX what encryption ciphers to use, the location of our certs and adds some extra security measures to the html headers.

So from the above we need to edit the following

ssl_certificate      SSL/cert.pem;
ssl_certificate_key  SSL/private.key;

This is the location of our cert.pem and private.key. I have them located in my NGINX folder in the following location C:\NGINX\config\SSLNGINX To find out how to create the Certs please use the guide Easy Let's Encrypt Certificates At the bottom it describes how to create .pem certs.

Next part we need to change from the above is

add_header Content-Security-Policy "frame-ancestors mysite.com emby.mysite.com;";

Change mysite.com emby.mysite.com to your Domain names. Also you need to add in here ALL your other sub domains that NGINX will manage. for example mysite.com emby.mysite.com sonarr.mysite.com

The next block is the location block, add this to your notepad.

         location / {
            proxy_pass http://127.0.0.1:8096;  

            proxy_set_header Range $http_range;
            proxy_set_header If-Range $http_if_range;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header Host $host;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "upgrade";
            }
    }
}

The location block tells NGINX what to do when it received data and where to forward it to. It is also required for web sockets to work.

Edit the proxy_pass and point it to the location of your Emby Server. If it is running on the same machine as NGINX you can leave it as http://127.0.0.1:8096. If its running on another machine you will need to know the IP. http://192.168.1.10:8096 etc.

    location / {
    proxy_pass http://127.0.0.1:8096;  

The whole config should now look like this.

worker_processes  2;

events {
    worker_connections  8192;
}


http {
    include       mime.types;
    default_type  application/octet-stream;
    server_tokens off;

    gzip on;
    gzip_disable "msie6";

    gzip_comp_level 6;
    gzip_min_length 1100;
    gzip_buffers 16 8k;
    gzip_proxied any;
    gzip_types
    text/plain
    text/css
    text/js
    text/xml
    text/javascript
    application/javascript
    application/x-javascript
    application/json
    application/xml
    application/rss+xml
    image/svg+xml;

    tcp_nodelay on;

    sendfile        off;

    server_names_hash_bucket_size 128;
    map_hash_bucket_size 64;

## Start: Timeouts ##
    client_body_timeout   10;
    client_header_timeout 10;
    keepalive_timeout     30;
    send_timeout          10;
    keepalive_requests    10;
## End: Timeouts ##



## Default Listening ##

server {
    listen 80 default_server;
    listen [::]:80 default_server;
    server_name _;


      return 301 https://$host$request_uri;
}   

##EMBY Server##

    server {
    listen [::]:443 ssl http2;
    listen 443 ssl http2;
    server_name emby.mysite.com; 

        ssl_session_timeout 30m;
        ssl_protocols TLSv1.2 TLSv1.1 TLSv1;
        ssl_certificate      SSL/cert.pem;
        ssl_certificate_key  SSL/private.key;
        ssl_session_cache shared:SSL:10m;
        ssl_prefer_server_ciphers on;
        ssl_ciphers ECDH+AESGCM:ECDH+AES256:ECDH+AES128:DH+3DES:!ADH:!AECDH:!MD5;


        add_header X-Xss-Protection "1; mode=block" always;
        add_header X-Content-Type-Options "nosniff" always;
        add_header Strict-Transport-Security "max-age=2592000; includeSubdomains" always;
        add_header X-Frame-Options "SAMEORIGIN" always;
        proxy_hide_header X-Powered-By;
        add_header 'Referrer-Policy' 'no-referrer';
        add_header Content-Security-Policy "frame-ancestors mysite.com emby.mysite.com;";


     location / {
        proxy_pass http://127.0.0.1:8096;  

        proxy_set_header Range $http_range;
        proxy_set_header If-Range $http_if_range;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        }


}
}

Save the notepad as nginx.config in the following location C:\NGINX\config

Step 3 - Set NGINX as a Windows Service

To get NGINX to start with Windows we need to donwload an application called NSSM (Non-sucking service manager). Download it and extract it. You will have a choice to use win32 or win64 version. Choice the version that relates to your Windows installation. Copy the nssm.exe to C:\Windows\System32

Open up a command prompt (Run as administrator) type the following

nssm install NGINX

It will now display this

NGINX

Fill in the Path to the NGINX.exe and the Startup Directory as above.

Click ok

enter image description here

Open up Service.msc and find the NGINX Service we just installed.

Right click and Start.

enter image description here

To Test, we can navigate to emby.mysite.com and it should bring up your Emby Server!

If you have any problems drop a comment below. I will also be creating a Troubleshooting NGINX post soon.


Author: Swynol

Main Admin