jfa-go VS vouch-proxy

Seen this post? https://github.com/hrfee/jfa-go/issues/141 he added Google smtp support to the unstable build a while ago and works fine. Not sure he ever added it to the stable build.

Look into jfa-go. I run it on the side and it hard-integrates into Jellyfin and adds a lot of account management stuff and the group/policy specific config you're mentioning

https://github.com/hrfee/jfa-go

It is a bit tedious if you don’t do it every time you make a new user. You can do some mass editing with jfa-go, but I don’t know the details because I’ve never used it before.

You can create different accounts for each person, like profiles and so... And there's even a project (albeit abandoned as per their GitHub) that lets you have a sign up page. I'm not sure if that's what you are looking for

I also recommend trying jfa-go for managing Jellyfin users. Allows you to create a template user and kinda tie things together if you attach an email. Then, as the other reply said, use Jellyseerr (which is 10x faster than Ombi) and your account woes disappear...mostly...

maybe you can work with https://github.com/hrfee/jfa-go to make it better?

jfa-go is really good, and has a lot of the same functionality. It is what I have been using

Jfa-GO

A similar tool for Jellyfin is jfa-go.

Look into vouch proxy

Vouch proxy is designed for this usage: https://github.com/vouch/vouch-proxy I don't think there are any nice UIs to configure it though so you'll need to be familiar with running it yourself.

Not sure this is a "best practice", but it lets me keep control of the Ingress resources inside their YAML configs. I've also layered Vouch Proxy into the ingress configurations to require SSO/MFA auth to access the resources behind the Ingress. Cloudflare has the ability to do this, but I found it cumbersome to keep track of the configs outside the K8s cluster.

I've used vouch proxy for my own stuff previously, before more recently moving to Cloudflare Access. vouch can be slightly janky at times to get working right, but once set up, it's been solid.

For example: nginx -> Vouch proxy -> KeyCloak -> Jellyfin

While this works, we were hoping to make access a bit easier with say an OpenID Connect SSO and reverse-proxy solution. I've seen Vouch Proxy, https://github.com/vouch/vouch-proxy which is really just SSO on top of nginx, but I'm wondering if there's a simpler way to do this.

You seem to be quite knowledgeable and a minimal provider with just the bare minimum would suffice for you. Have a look at Vouch Proxy, it does one thing and it does it well.