diff --git a/hosts/Dimaga/default.nix b/hosts/Dimaga/default.nix index ed16aad..1b56c10 100644 --- a/hosts/Dimaga/default.nix +++ b/hosts/Dimaga/default.nix @@ -19,6 +19,7 @@ let config.secrets.services.cache.url config.secrets.services.forgejo.url config.secrets.services.gremlin-lab.url + config.secrets.services.jellyfin.url ]; namecheapCredentials = { @@ -118,6 +119,13 @@ in domain = config.secrets.networking.primaryDomain; url = config.secrets.services.airsonic.url; }; + jellyfin = { + enable = true; + autostart = false; + home = "${services-root}/jellyfin"; + domain = config.secrets.networking.primaryDomain; + url = config.secrets.services.jellyfin.url; + }; autoUpgrade = { enable = false; # Don't update the system... pushUpdates = true; # ...but do push updates remotely. diff --git a/modules/services/jellyfin.nix b/modules/services/jellyfin.nix new file mode 100644 index 0000000..3839d66 --- /dev/null +++ b/modules/services/jellyfin.nix @@ -0,0 +1,93 @@ +{ + pkgs, + config, + lib, + ... +}: +let + cfg = config.aux.system.services.jellyfin; +in +{ + options = { + aux.system.services.jellyfin = { + autostart = lib.mkEnableOption (lib.mdDoc "Automatically starts Jellyfin at boot."); + enable = lib.mkEnableOption (lib.mdDoc "Enables the Jellyfin media streaming service."); + home = lib.mkOption { + default = ""; + type = lib.types.str; + description = "Where to store Jellyfin's files"; + }; + domain = lib.mkOption { + default = ""; + type = lib.types.str; + description = "The root domain that Jellyfin will be hosted on."; + example = "example.com"; + }; + url = lib.mkOption { + default = ""; + type = lib.types.str; + description = "The complete URL where Jellyfin is hosted."; + example = "https://jellyfin.example.com"; + }; + }; + }; + + config = lib.mkIf cfg.enable { + aux.system.users.media.enable = true; + users.users.jellyfin.extraGroups = [ "media" ]; + + services = { + nginx.virtualHosts."${cfg.url}" = { + useACMEHost = cfg.domain; + forceSSL = true; + locations."/" = { + proxyPass = "http://127.0.0.1:8096"; + proxyWebsockets = true; + extraConfig = '' + # Taken from https://jellyfin.org/docs/general/networking/nginx/ + client_max_body_size 20M; + + # Security / XSS Mitigation Headers + # NOTE: X-Frame-Options may cause issues with the webOS app + add_header X-Frame-Options "SAMEORIGIN"; + add_header X-Content-Type-Options "nosniff"; + + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header X-Forwarded-Protocol $scheme; + proxy_set_header X-Forwarded-Host $host; + + # Disable buffering when the nginx proxy gets very resource heavy upon streaming + proxy_buffering off; + ''; + }; + locations."/socket" = { + proxyPass = "http://127.0.0.1:8096"; + proxyWebsockets = true; + extraConfig = '' + # Proxy Jellyfin Websockets traffic + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection "upgrade"; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header X-Forwarded-Protocol $scheme; + proxy_set_header X-Forwarded-Host $host; + ''; + }; + }; + + jellyfin = { + enable = true; + dataDir = lib.mkIf (cfg.home != "") cfg.home; + }; + }; + + systemd.services.nginx.wants = [ config.systemd.services.jellyfin.name ]; + # Disable autostart if configured + systemd.services.jellyfin = lib.mkIf (!cfg.autostart) { wantedBy = lib.mkForce [ ]; }; + }; +} diff --git a/nix-secrets b/nix-secrets index e63567d..673b60b 160000 --- a/nix-secrets +++ b/nix-secrets @@ -1 +1 @@ -Subproject commit e63567dbb3da53348fe83993d9f8a48d9dff2629 +Subproject commit 673b60b1a7e8a86114c9550cb38724cc675cf8f2