Building a Self-Hosted Media Cloud: GPU Transcoding and Reverse Proxy Deployments (CineVault Architecture)

Deploying a private media library (like Jellyfin or Plex) on a home lab server is a common project. However, streaming high-bitrate 4K content to a phone or tablet outside your local network requires real-time hardware transcoding to prevent buffering and avoid pegging the host CPU at 100% utilization. This guide details how to configure GPU passthrough within Docker containers and secure administrative interfaces using reverse proxies.

1. Enabling GPU Device Passthrough in Docker

By default, Docker containers cannot communicate with host hardware accelerators. To resolve this, map the host GPU interfaces inside your docker-compose.yml service configurations.

For Intel Graphics (Intel QuickSync - QSV)

On Intel-based systems, map the Direct Rendering Infrastructure (DRI) character devices (/dev/dri):

services:
  jellyfin:
    image: jellyfin/jellyfin:latest
    container_name: mediaserver-core
    devices:
      - /dev/dri:/dev/dri
    # Uncomment + set YOUR render GID (run: getent group render)
    # group_add:
    #   - "104"
    volumes:
      - /opt/jellyfin/config:/config
      - /opt/jellyfin/cache:/cache
      - /DATA/media:/data
    networks:
      - media-net
    restart: always

networks:
  media-net:
    driver: bridge

For NVIDIA Graphics (NVENC)

On NVIDIA systems, install the NVIDIA Container Toolkit on your host OS and expose the GPU capabilities inside the docker compose deployment reservations:

services:
  jellyfin:
    image: jellyfin/jellyfin:latest
    container_name: mediaserver-core
    deploy:
      resources:
        reservations:
          devices:
            - driver: nvidia
              count: all
              capabilities: [gpu]
    volumes:
      - /opt/jellyfin/config:/config
      - /opt/jellyfin/cache:/cache
      - /DATA/media:/data
    networks:
      - media-net
    restart: always

networks:
  media-net:
    driver: bridge

How to Identify Your Host GPU & Driver Status

Before writing your Docker configurations, run these diagnostic commands on your host Linux terminal to identify your hardware and verify driver presence:

• Check physical hardware controllers:

  lspci | grep -Ei 'vga|3d|display'

  This command lists all graphics cards installed on your motherboard (e.g., *Intel Corporation UHD Graphics* or *NVIDIA Corporation GA106*).
• For Intel QuickSync (QSV): Verify that Direct Rendering Infrastructure kernel nodes exist:

  ls -la /dev/dri

  If you see character devices named card0 and renderD128, your Intel integrated graphics drivers are active and ready.
• For NVIDIA (NVENC): Verify that the official NVIDIA proprietary drivers are installed and running on the host system:

  nvidia-smi

  If this prints a status screen showing your GPU model name, active memory allocation, and CUDA version, your driver stack is fully functional.

2. Verifying Transcoding Inside the Container

Once the container is running, verify that the card is accessible by executing rendering commands inside the container namespace:

# For Intel devices, check if rendering nodes are visible
docker exec -it mediaserver-core ls -la /dev/dri

# Run ffmpeg test to ensure encoder codecs are registered
docker exec -it mediaserver-core jellyfin-ffmpeg -decoders | grep qsv

If the terminal outputs available QSV codecs (like h264_qsv or hevc_qsv), hardware acceleration is configured successfully.

3. Securing Access with Caddy Reverse Proxy

Avoid exposing port 8096 directly. Setup a reverse proxy like Caddy to manage automatic SSL certification via Let's Encrypt, block public access to sensitive administrative dashboards, and route client traffic securely.

Create a Caddyfile on your host server to route requests securely:

# Run Caddy in Docker on the SAME media-net network as Jellyfin,
# otherwise the mediaserver-core hostname will not resolve.
# (docker-compose.yml for caddy: image caddy:2-alpine, volumes for
#  ./Caddyfile:/etc/caddy/Caddyfile + caddy_data, networks: [media-net])
media.your-domain.com {
    # Route all traffic to the container
    reverse_proxy mediaserver-core:8096

    # Jellyfin's dashboard is a client-side route: the part after #
    # in /web/index.html#!/dashboard never reaches the server, so it
    # cannot be matched here. Restrict the whole /web app to LAN instead.
    @admin_paths {
        path /web/*
        not remote_ip 192.168.0.0/16 10.0.0.0/8
    }

    # Deny non-local access attempts with a 403 Forbidden status
    respond @admin_paths "Access Denied: Admin paths restricted to local network." 403
}

This allows external users to watch media streams securely, but prevents anyone outside your private network from accessing administrative consoles or modifying server configurations.