peperunas/nixos
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

jellyfin: vhost

Browse Source
This commit is contained in:
Giulio De Pasquale 2023-06-05 03:11:46 +02:00
parent 2f43745162
commit f2e33628c0
1 changed files with 22 additions and 33 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

55
hosts/architect/jellyfin.nix
View File

@ -3,52 +3,41 @@
let let
domain = "media.giugl.io"; domain = "media.giugl.io";
port = 8096; port = 8096;
allowLan = true;
utilities = import ./utilities.nix { inherit lib config; };
inherit (utilities) architectInterfaceAddress;
in in
{ {
# needed since StateDirectory does not accept symlinks # needed since StateDirectory does not accept symlinks
systemd.services.jellyfin.serviceConfig.StateDirectory = lib.mkForce ""; systemd.services.jellyfin.serviceConfig.StateDirectory = lib.mkForce "";
services = { architect.vhost.${domain} = with config.architect.networks; {
jellyfin = { dnsInterfaces = [ "lan" "wireguard" "tailscale" ];
enable = true; locations = {
group = "media"; "/" = {
package = pkgs.unstablePkgs.jellyfin; inherit port allowLan;
};
nginx.virtualHosts.${domain} = { allow = [
forceSSL = true; wireguard.net
enableACME = true; tailscale.net
extraConfig = '' ];
# External Javascript (such as cast_sender.js for Chromecast) must be whitelisted.
#add_header Content-Security-Policy "default-src https: data: blob: http://image.tmdb.org; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' https://www.gstatic.com/cv/js/sender/v1/cast_sender.js https://www.gstatic.com/eureka/clank/95/cast_sender.js https://www.gstatic.com/eureka/clank/96/cast_sender.js https://www.gstatic.com/eureka/clank/97/cast_sender.js https://www.youtube.com blob:; worker-src 'self' blob:; connect-src 'self'; object-src 'none'; frame-ancestors 'self'";
# Disable buffering when the nginx proxy gets very resource heavy upon streaming
proxy_buffering off;
allow ${config.architect.networks.lan.net};
allow ${config.architect.networks.tailscale.net};
deny all;
'';
locations."/" = {
proxyPass = "http://127.0.0.1:${toString port}";
}; };
locations."/socket" = { "/socket" = {
proxyPass = "http://127.0.0.1:${toString port}"; inherit port allowLan;
proxyWebsockets = true; proxyWebsockets = true;
allow = [
wireguard.net
tailscale.net
];
}; };
}; };
}; };
services.jellyfin = {
networking.extraHosts = '' enable = true;
${architectInterfaceAddress "lan"} ${domain} group = "media";
${architectInterfaceAddress "wireguard"} ${domain} package = pkgs.unstablePkgs.jellyfin;
${architectInterfaceAddress "tailscale"} ${domain} };
'';
users.groups = { users.groups = {
media.members = [ "jellyfin" ]; media.members = [ "jellyfin" ];