No more media playback

[jameskimmel]

Describe the bug

Remote and local AppleTV will no longer play any files. Both go through a NGINX reverse proxy, with SSL and a valid certificate.
I think this issue started with Jellyfin Server 10.10.6.

The strange thing is that in the admin server overview, under active devices, I can see the player running and the time counting up.
But the TV screen output stays black.

File is direct playing.

Works in Browsers, Swiftfin on iOS (iPhone), Swiftfin on macOS.

Happy to provide more details that help to hunt down this issue.

Logs look normal to me.

[2025-04-02 21:56:01.816 +02:00] [WRN] IPv6 is disabled in Jellyfin, but enabled in the OS. This may affect how the interface is selected.
[2025-04-02 21:56:53.758 +02:00] [WRN] WS "2a02:" error receiving data: "The remote party closed the WebSocket connection without completing the close handshake."
[2025-04-02 21:56:53.758 +02:00] [INF] WS "2a02:" closed
[2025-04-02 21:56:53.758 +02:00] [INF] Lost 1 WebSockets.
[2025-04-02 21:57:37.377 +02:00] [WRN] WS "2a02:" error receiving data: "The remote party closed the WebSocket connection without completing the close handshake."
[2025-04-02 21:57:37.377 +02:00] [INF] WS "2a02:" closed
[2025-04-02 21:57:37.398 +02:00] [INF] Playback stopped reported by app "Jellyfin tvOS" "1.0.1" playing "Fremd- und nicht gut gegangen". Stopped at "0" ms
[2025-04-02 21:57:45.349 +02:00] [INF] User policy for "Username". EnablePlaybackRemuxing: True EnableVideoPlaybackTranscoding: False EnableAudioPlaybackTranscoding: True
[2025-04-02 21:57:45.430 +02:00] [INF] User policy for "Username". EnablePlaybackRemuxing: True EnableVideoPlaybackTranscoding: False EnableAudioPlaybackTranscoding: True
[2025-04-02 21:57:45.430 +02:00] [INF] User policy for "Username". EnablePlaybackRemuxing: True EnableVideoPlaybackTranscoding: False EnableAudioPlaybackTranscoding: True

So my best guess is that something changed regarding IPv6.

Here is my IPv6 config.

• My domain.com is dual stack.
• NGINX listenes on both, IPv4 and IPv6
• NGINX proxy passes to the IPv4 10.0.10.3 of the Jellyfin host.
• The Jellyfin host is a Debian VM, also with dual stack
• Jellyfin host has only IPv4 enabled in network settings, since I will only get traffic from IPv4
• Local DNS (pihole) has an override rule, to override jelly.mydomain.com to IPv4 of NGINX 10.0.10.2.

Maybe all of a sudden jellyfin no longer allows access from proxy passed IPv6, if this isn't enabled under networks?

Application version

1.0.1(70)

Where did you install the app from?

App Store

Device information

AppleTV 4k

OS version

tvOS 18.4

Jellyfin server version

10.10.6

[JPKribs]

Hi, it's not likely something has changed from the Swiftfin side as the tvOS app has not received an update in a while. You can track our progress towards our next release here: #1294

That being said, the Device Profiles and Transcoding configuration for tvOS is quite a bit behind iOS. I could be wrong, but this behavior sounds like a playback issue with an incompatible file type. Can you confirm this applies to all files or just some files? Additionally, do you have "Force Direct Play" enabled? If so, I would recommend turning that off and trying again. I would also try seeing between Native and Swiftfin player as they both have differing capabilities.

Let me know if neither of those resolve this!

[jameskimmel]

Hi @JPKribs
Agree, that is why I wrote that it happens since the last server update.

Yes it affects all media. And this is also pretty primitive media (no hdr, h.264, aac).

I will try your suggestions, but even if they do help, I find it strange that it no longer works, because it used to work fine.

[jameskimmel]

I just tested it.

What does not work:
Force off & native off
Force on & native off

What works:
Force off & native on
Force on & native on

[JPKribs]

Do you know if you have TLS 1.3 only for NGINX enabled? It sounds like VLCKit (our non-native player) isn't working which lets us pinpoint this a little better. I know VLCKit doesn't work with TLS 1.3 so fallback to 1.2 is still required at this time.

When you say local, are you still running through NGINX? If so, would you be able to try the native player disabled using the pure IP? That helps us determine if it's purely Jellyfin/Swiftfin of if something with the Proxy is giving us trouble.

[jameskimmel]

Do you know if you have TLS 1.3 only for NGINX enabled?

TLSv1.2 and TLSv1.3 is enabled.

When you say local, are you still running through NGINX?

It is the same for local and remote. And also both go through NGINX, since local has a DNS override.

If so, would you be able to try the native player disabled using the pure IP?

Well, since native works, I am not sure why you would want to test this.

That helps us determine if it's purely Jellyfin/Swiftfin of if something with the Proxy is giving us trouble.

Do you mean try to run it with a local IP and without the native player?

[JPKribs]

Apologies for my wording. That was more confusing than I intended it to be. Yes, let's try turning the native player off and using the pure IP. This will use VLCKIT and confirm whether the issue is purely on the Jellyfin side or if it's VLCKIT not cooperating with the proxy.

[jameskimmel]

Unfortunately I am not able to connect to Jellyfin directly.
http://10.0.10.3:8089 is also not accessible in the Browser.
I currently don't know why and unfortunately have to go for today.

[JPKribs]

No worries! When you have a chance to test it, please let me know. Right now, I'm leaning towards a potential update with your proxy causing this issue? If it is on the Jellyfin side, we can definitely open up an issue over there. Unfortunately, VLCKIT is a little more fragile than AVKIT, which is our native player. So, there is also a chance that this is something related to a custom header, which VLCKIT does not cooperate with. Or, this could just be related to something else in that area.

Looking over at VLCKIT, IPv6 shouldn't impact anything? That being said, please let me know what you end up finding and I can definitely assist in making sure we either document what you're seeing or, if it's something we're able to resolve, get that on the list!

[jameskimmel]

I was not able to connect to Jellyfin directly and I am unable to find out why.

Right now, I'm leaning towards a potential update with your proxy causing this issue

That would also be my natural instinct, but besides updating NGINX and Jellyfin I did not change any configs.

Looking over at VLCKIT, IPv6 shouldn't impact anything?

Hard to tell, but I guess no. The one remote client experiencing that issue is using IPv6 (that will get proxy passed to NGINX IPv4) while to local client has a DNS override that points only points to the IPv4 of NGINX. No AAAA record.

I even changed my NGIXN config to the bare minimum to rule out any potential issues (like disabling ssl stapling).

[jameskimmel]

Some strange things I found in the NGINX error.log

2025/04/03 02:03:38 [error] 1035#1035: recv() failed (111: Connection refused) while resolving, resolver: 208.67.222.222:53

Not any of my DNS resolvers.

and this:

2025/04/03 02:03:40 [error] 1035#1035: e5.o.lencr.org could not be resolved (110: Operation timed out) while requesting certificate status, responder: e5.o.lencr.org, certificate: "/etc/letsencrypt/live/jelly.mydomain.com/fullchain.pem"

Did something regarding DNS change with the new Jellyfin server 10.10.6?

[jameskimmel]

Sorry for the delay. Had to delete my jelly.mydomain.com server to be able to add http://localipv4:8090.
Using the local IP works, so it seems like it really is related to my NGINX config.

I am at a complete loss here. I changed my settings to 1:1 copy of this https://jellyfin.org/docs/general/networking/nginx but it still won't work.