Dimaga: add Jellyfin

hosts/Dimaga/default.nix

@@ -19,6 +19,7 @@ let
     config.secrets.services.cache.url
     config.secrets.services.forgejo.url
     config.secrets.services.gremlin-lab.url
+    config.secrets.services.jellyfin.url
   ];
 
   namecheapCredentials = {
@@ -118,6 +119,13 @@ in
         domain = config.secrets.networking.primaryDomain;
         url = config.secrets.services.airsonic.url;
       };
+      jellyfin = {
+        enable = true;
+        autostart = false;
+        home = "${services-root}/jellyfin";
+        domain = config.secrets.networking.primaryDomain;
+        url = config.secrets.services.jellyfin.url;
+      };
       autoUpgrade = {
         enable = false; # Don't update the system...
         pushUpdates = true; # ...but do push updates remotely.

modules/services/airsonic.nix

@@ -52,7 +52,6 @@ in
             proxy_set_header Host              $host;
             proxy_max_temp_file_size           0;
             proxy_ssl_server_name on;
-            add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' www.gstatic.com; img-src 'self' *.akamaized.net; style-src 'self' 'unsafe-inline' fonts.googleapis.com; font-src 'self' fonts.gstatic.com; frame-src 'self'; object-src 'none'";
           '';
         };
       };

modules/services/jellyfin.nix

@@ -0,0 +1,93 @@
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}:
+let
+  cfg = config.aux.system.services.jellyfin;
+in
+{
+  options = {
+    aux.system.services.jellyfin = {
+      autostart = lib.mkEnableOption (lib.mdDoc "Automatically starts Jellyfin at boot.");
+      enable = lib.mkEnableOption (lib.mdDoc "Enables the Jellyfin media streaming service.");
+      home = lib.mkOption {
+        default = "";
+        type = lib.types.str;
+        description = "Where to store Jellyfin's files";
+      };
+      domain = lib.mkOption {
+        default = "";
+        type = lib.types.str;
+        description = "The root domain that Jellyfin will be hosted on.";
+        example = "example.com";
+      };
+      url = lib.mkOption {
+        default = "";
+        type = lib.types.str;
+        description = "The complete URL where Jellyfin is hosted.";
+        example = "https://jellyfin.example.com";
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    aux.system.users.media.enable = true;
+    users.users.jellyfin.extraGroups = [ "media" ];
+
+    services = {
+      nginx.virtualHosts."${cfg.url}" = {
+        useACMEHost = cfg.domain;
+        forceSSL = true;
+        locations."/" = {
+          proxyPass = "http://127.0.0.1:8096";
+          proxyWebsockets = true;
+          extraConfig = ''
+            # Taken from https://jellyfin.org/docs/general/networking/nginx/
+             client_max_body_size 20M;
+                        
+            # Security / XSS Mitigation Headers
+            # NOTE: X-Frame-Options may cause issues with the webOS app
+            add_header X-Frame-Options "SAMEORIGIN";
+            add_header X-Content-Type-Options "nosniff";
+
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header X-Forwarded-Protocol $scheme;
+            proxy_set_header X-Forwarded-Host $host;
+
+            # Disable buffering when the nginx proxy gets very resource heavy upon streaming
+            proxy_buffering off;
+          '';
+        };
+        locations."/socket" = {
+          proxyPass = "http://127.0.0.1:8096";
+          proxyWebsockets = true;
+          extraConfig = ''
+            # Proxy Jellyfin Websockets traffic
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection "upgrade";
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header X-Forwarded-Protocol $scheme;
+            proxy_set_header X-Forwarded-Host $host;
+          '';
+        };
+      };
+
+      jellyfin = {
+        enable = true;
+        dataDir = lib.mkIf (cfg.home != "") cfg.home;
+      };
+    };
+
+    systemd.services.nginx.wants = [ config.systemd.services.jellyfin.name ];
+    # Disable autostart if configured
+    systemd.services.jellyfin = lib.mkIf (!cfg.autostart) { wantedBy = lib.mkForce [ ]; };
+  };
+}

nix-secrets

@@ -1 +1 @@
-Subproject commit e63567dbb3da53348fe83993d9f8a48d9dff2629
+Subproject commit 673b60b1a7e8a86114c9550cb38724cc675cf8f2