hosts/Dimaga/default.nix

@@ -19,7 +19,6 @@ let
     config.secrets.services.cache.url
     config.secrets.services.forgejo.url
     config.secrets.services.gremlin-lab.url
-    config.secrets.services.jellyfin.url
   ];
 
   namecheapCredentials = {
@@ -119,13 +118,6 @@ in
         domain = config.secrets.networking.primaryDomain;
         url = config.secrets.services.airsonic.url;
       };
-      jellyfin = {
-        enable = true;
-        autostart = false;
-        home = "${services-root}/jellyfin";
-        domain = config.secrets.networking.primaryDomain;
-        url = config.secrets.services.jellyfin.url;
-      };
       autoUpgrade = {
         enable = false; # Don't update the system...
         pushUpdates = true; # ...but do push updates remotely.

modules/services/airsonic.nix

@@ -52,6 +52,7 @@ in
             proxy_set_header Host              $host;
             proxy_max_temp_file_size           0;
             proxy_ssl_server_name on;
+            add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' www.gstatic.com; img-src 'self' *.akamaized.net; style-src 'self' 'unsafe-inline' fonts.googleapis.com; font-src 'self' fonts.gstatic.com; frame-src 'self'; object-src 'none'";
           '';
         };
       };

modules/services/jellyfin.nix

@@ -1,93 +0,0 @@
-{
-  pkgs,
-  config,
-  lib,
-  ...
-}:
-let
-  cfg = config.aux.system.services.jellyfin;
-in
-{
-  options = {
-    aux.system.services.jellyfin = {
-      autostart = lib.mkEnableOption (lib.mdDoc "Automatically starts Jellyfin at boot.");
-      enable = lib.mkEnableOption (lib.mdDoc "Enables the Jellyfin media streaming service.");
-      home = lib.mkOption {
-        default = "";
-        type = lib.types.str;
-        description = "Where to store Jellyfin's files";
-      };
-      domain = lib.mkOption {
-        default = "";
-        type = lib.types.str;
-        description = "The root domain that Jellyfin will be hosted on.";
-        example = "example.com";
-      };
-      url = lib.mkOption {
-        default = "";
-        type = lib.types.str;
-        description = "The complete URL where Jellyfin is hosted.";
-        example = "https://jellyfin.example.com";
-      };
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    aux.system.users.media.enable = true;
-    users.users.jellyfin.extraGroups = [ "media" ];
-
-    services = {
-      nginx.virtualHosts."${cfg.url}" = {
-        useACMEHost = cfg.domain;
-        forceSSL = true;
-        locations."/" = {
-          proxyPass = "http://127.0.0.1:8096";
-          proxyWebsockets = true;
-          extraConfig = ''
-            # Taken from https://jellyfin.org/docs/general/networking/nginx/
-             client_max_body_size 20M;
-                        
-            # Security / XSS Mitigation Headers
-            # NOTE: X-Frame-Options may cause issues with the webOS app
-            add_header X-Frame-Options "SAMEORIGIN";
-            add_header X-Content-Type-Options "nosniff";
-
-            proxy_set_header Host $host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $scheme;
-            proxy_set_header X-Forwarded-Protocol $scheme;
-            proxy_set_header X-Forwarded-Host $host;
-
-            # Disable buffering when the nginx proxy gets very resource heavy upon streaming
-            proxy_buffering off;
-          '';
-        };
-        locations."/socket" = {
-          proxyPass = "http://127.0.0.1:8096";
-          proxyWebsockets = true;
-          extraConfig = ''
-            # Proxy Jellyfin Websockets traffic
-            proxy_set_header Upgrade $http_upgrade;
-            proxy_set_header Connection "upgrade";
-            proxy_set_header Host $host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $scheme;
-            proxy_set_header X-Forwarded-Protocol $scheme;
-            proxy_set_header X-Forwarded-Host $host;
-          '';
-        };
-      };
-
-      jellyfin = {
-        enable = true;
-        dataDir = lib.mkIf (cfg.home != "") cfg.home;
-      };
-    };
-
-    systemd.services.nginx.wants = [ config.systemd.services.jellyfin.name ];
-    # Disable autostart if configured
-    systemd.services.jellyfin = lib.mkIf (!cfg.autostart) { wantedBy = lib.mkForce [ ]; };
-  };
-}

nix-secrets

@@ -1 +1 @@
-Subproject commit 673b60b1a7e8a86114c9550cb38724cc675cf8f2
+Subproject commit e63567dbb3da53348fe83993d9f8a48d9dff2629