1
0
Fork 0

Compare commits

...

2 commits

4 changed files with 102 additions and 2 deletions

View file

@ -19,6 +19,7 @@ let
config.secrets.services.cache.url config.secrets.services.cache.url
config.secrets.services.forgejo.url config.secrets.services.forgejo.url
config.secrets.services.gremlin-lab.url config.secrets.services.gremlin-lab.url
config.secrets.services.jellyfin.url
]; ];
namecheapCredentials = { namecheapCredentials = {
@ -118,6 +119,13 @@ in
domain = config.secrets.networking.primaryDomain; domain = config.secrets.networking.primaryDomain;
url = config.secrets.services.airsonic.url; url = config.secrets.services.airsonic.url;
}; };
jellyfin = {
enable = true;
autostart = false;
home = "${services-root}/jellyfin";
domain = config.secrets.networking.primaryDomain;
url = config.secrets.services.jellyfin.url;
};
autoUpgrade = { autoUpgrade = {
enable = false; # Don't update the system... enable = false; # Don't update the system...
pushUpdates = true; # ...but do push updates remotely. pushUpdates = true; # ...but do push updates remotely.

View file

@ -52,7 +52,6 @@ in
proxy_set_header Host $host; proxy_set_header Host $host;
proxy_max_temp_file_size 0; proxy_max_temp_file_size 0;
proxy_ssl_server_name on; proxy_ssl_server_name on;
add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' www.gstatic.com; img-src 'self' *.akamaized.net; style-src 'self' 'unsafe-inline' fonts.googleapis.com; font-src 'self' fonts.gstatic.com; frame-src 'self'; object-src 'none'";
''; '';
}; };
}; };

View file

@ -0,0 +1,93 @@
{
pkgs,
config,
lib,
...
}:
let
cfg = config.aux.system.services.jellyfin;
in
{
options = {
aux.system.services.jellyfin = {
autostart = lib.mkEnableOption (lib.mdDoc "Automatically starts Jellyfin at boot.");
enable = lib.mkEnableOption (lib.mdDoc "Enables the Jellyfin media streaming service.");
home = lib.mkOption {
default = "";
type = lib.types.str;
description = "Where to store Jellyfin's files";
};
domain = lib.mkOption {
default = "";
type = lib.types.str;
description = "The root domain that Jellyfin will be hosted on.";
example = "example.com";
};
url = lib.mkOption {
default = "";
type = lib.types.str;
description = "The complete URL where Jellyfin is hosted.";
example = "https://jellyfin.example.com";
};
};
};
config = lib.mkIf cfg.enable {
aux.system.users.media.enable = true;
users.users.jellyfin.extraGroups = [ "media" ];
services = {
nginx.virtualHosts."${cfg.url}" = {
useACMEHost = cfg.domain;
forceSSL = true;
locations."/" = {
proxyPass = "http://127.0.0.1:8096";
proxyWebsockets = true;
extraConfig = ''
# Taken from https://jellyfin.org/docs/general/networking/nginx/
client_max_body_size 20M;
# Security / XSS Mitigation Headers
# NOTE: X-Frame-Options may cause issues with the webOS app
add_header X-Frame-Options "SAMEORIGIN";
add_header X-Content-Type-Options "nosniff";
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Protocol $scheme;
proxy_set_header X-Forwarded-Host $host;
# Disable buffering when the nginx proxy gets very resource heavy upon streaming
proxy_buffering off;
'';
};
locations."/socket" = {
proxyPass = "http://127.0.0.1:8096";
proxyWebsockets = true;
extraConfig = ''
# Proxy Jellyfin Websockets traffic
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Protocol $scheme;
proxy_set_header X-Forwarded-Host $host;
'';
};
};
jellyfin = {
enable = true;
dataDir = lib.mkIf (cfg.home != "") cfg.home;
};
};
systemd.services.nginx.wants = [ config.systemd.services.jellyfin.name ];
# Disable autostart if configured
systemd.services.jellyfin = lib.mkIf (!cfg.autostart) { wantedBy = lib.mkForce [ ]; };
};
}

@ -1 +1 @@
Subproject commit e63567dbb3da53348fe83993d9f8a48d9dff2629 Subproject commit 673b60b1a7e8a86114c9550cb38724cc675cf8f2