Configure Jellyfin

dns.tf

@@ -1,5 +1,6 @@
 locals {
   dmarc_value = "\"v=DMARC1; p=none; rua=mailto:failed-dmarc@banditlair.com; ruf=mailto:dmarc@banditlair.com\""
+  storage1_ip = "78.46.96.243"
 }
 
 data "hetznerdns_zone" "banditlair_zone" {
@@ -25,11 +26,18 @@ resource "hetznerdns_record" "backend1_a" {
 resource "hetznerdns_record" "mail2_a" {
   zone_id = data.hetznerdns_zone.banditlair_zone.id
   name    = "mail2"
-  value   = "78.46.96.243"
+  value   = local.storage1_ip
   type    = "A"
   ttl     = 600
 }
 
+resource "hetznerdns_record" "jellyfin_a" {
+  zone_id = data.hetznerdns_zone.banditlair_zone.id
+  name    = "jellyfin"
+  value   = local.storage1_ip
+  type    = "A"
+  ttl     = 600
+}
 resource "hetznerdns_record" "db1_a" {
   zone_id = data.hetznerdns_zone.banditlair_zone.id
   name    = "db1"

modules/jellyfin.nix

@@ -0,0 +1,33 @@
+{ config, lib, pkgs, ... }:
+{
+  services.jellyfin = {
+    enable = true;
+  };
+
+  systemd.services.jellyfin.serviceConfig.ExecStart =
+    lib.mkOverride 10 "${config.services.jellyfin.package}/bin/jellyfin --datadir '/nix/var/data/jellyfin' --cachedir '/var/cache/jellyfin'";
+
+  services.nginx.virtualHosts."jellyfin.${config.networking.domain}" = {
+    enableACME = true;
+    forceSSL = true;
+
+    locations."= /".extraConfig = ''
+      return 302 https://$host/web/;
+    '';
+
+    locations."/" = {
+      proxyPass = "http://127.0.0.1:8096";
+      extraConfig = ''
+        proxy_buffering off;
+      '';
+    };
+
+    locations."= /web/" = {
+      proxyPass = "http://127.0.0.1:8096/web/index.html";
+    };
+
+    locations."/socket" = {
+      proxyPass = "http://127.0.0.1:8096";
+    };
+  };
+}

modules/nextcloud.nix

@@ -55,14 +55,11 @@ in
     };
   };
 
-  services.nginx = {
+  services.nginx.virtualHosts."${config.services.nextcloud.hostName}" = {
-    virtualHosts = {
-      "${config.services.nextcloud.hostName}" = {
     enableACME = true;
     forceSSL = true;
   };
-    };
+
-  };
 
   services.nextcloud = {
     enable = true;

profiles/storage.nix

@@ -6,5 +6,8 @@
     ../modules/openssh.nix
     ../modules/mailserver.nix
     ../modules/nginx.nix
+    ../modules/jellyfin.nix
   ];
+
+  networking.firewall.allowedTCPPorts = [ 80 443 ];
 }