diff --git a/configurations/nixos/defiant/services.nix b/configurations/nixos/defiant/services.nix
index 97a6711..7ef6cde 100644
--- a/configurations/nixos/defiant/services.nix
+++ b/configurations/nixos/defiant/services.nix
@@ -69,23 +69,6 @@ in {
           default = "${config.apps.headscale.subdomain}.${config.apps.base_domain}";
         };
       };
-      jellyfin = {
-        subdomain = lib.mkOption {
-          type = lib.types.str;
-          description = "subdomain of base domain that jellyfin will be hosted at";
-          default = "jellyfin";
-        };
-        hostname = lib.mkOption {
-          type = lib.types.str;
-          description = "hostname that jellyfin will be hosted at";
-          default = "${config.apps.jellyfin.subdomain}.${config.apps.base_domain}";
-        };
-        mediaDirectory = lib.mkOption {
-          type = lib.types.str;
-          description = "directory that jellyfin will be at";
-          default = "/home/jellyfin";
-        };
-      };
       forgejo = {
         subdomain = lib.mkOption {
           type = lib.types.str;
@@ -194,7 +177,6 @@ in {
     # TODO: dynamic users
     systemd = {
       tmpfiles.rules = [
-        "d ${config.apps.jellyfin.mediaDirectory} 2775 jellyfin jellyfin_media -" # is /home/docker/jellyfin/media on existing server
         "d ${config.apps.pihole.directory.root} 755 pihole pihole -" # is /home/docker/pihole on old system
         "d ${config.apps.pihole.directory.data} 755 pihole pihole -" # is /home/docker/pihole on old system
       ];
@@ -325,10 +307,6 @@ in {
         };
       };
 
-      jellyfin = {
-        enable = true;
-      };
-
       forgejo = {
         enable = true;
         database = {
@@ -387,11 +365,6 @@ in {
               proxyWebsockets = true;
             };
           };
-          ${config.apps.jellyfin.hostname} = {
-            # forceSSL = true;
-            # enableACME = true;
-            locations."/".proxyPass = "http://localhost:${toString jellyfinPort}";
-          };
           ${config.apps.forgejo.hostname} = {
             # forceSSL = true;
             # enableACME = true;
@@ -433,9 +406,6 @@ in {
 
     environment.systemPackages = [
       config.services.headscale.package
-      pkgs.jellyfin
-      pkgs.jellyfin-web
-      pkgs.jellyfin-ffmpeg
     ];
   };
 }
diff --git a/modules/nixos-modules/server/default.nix b/modules/nixos-modules/server/default.nix
index 3c5c55f..7e4d36b 100644
--- a/modules/nixos-modules/server/default.nix
+++ b/modules/nixos-modules/server/default.nix
@@ -2,5 +2,6 @@
   imports = [
     ./network_storage
     ./reverse_proxy.nix
+    ./jellyfin.nix
   ];
 }
diff --git a/modules/nixos-modules/server/jellyfin.nix b/modules/nixos-modules/server/jellyfin.nix
new file mode 100644
index 0000000..81ad91a
--- /dev/null
+++ b/modules/nixos-modules/server/jellyfin.nix
@@ -0,0 +1,60 @@
+{
+  lib,
+  pkgs,
+  config,
+  ...
+}: let
+  jellyfinPort = 8096;
+in {
+  options.host.jellyfin = {
+    enable = lib.mkEnableOption "should jellyfin be enabled on this computer";
+    subdomain = lib.mkOption {
+      type = lib.types.str;
+      description = "subdomain of base domain that jellyfin will be hosted at";
+      default = "jellyfin";
+    };
+  };
+
+  config = lib.mkIf config.host.jellyfin.enable (
+    lib.mkMerge [
+      {
+        services.jellyfin.enable = true;
+        host.reverse_proxy.subdomains.${config.host.jellyfin.subdomain} = {
+          target = "http://localhost:${toString jellyfinPort}";
+        };
+        environment.systemPackages = [
+          pkgs.jellyfin
+          pkgs.jellyfin-web
+          pkgs.jellyfin-ffmpeg
+        ];
+      }
+      (lib.mkIf config.host.impermanence.enable {
+        # TODO: add an assertion here that directories matches jellyfin directories
+
+        environment.persistence."/persist/system/jellyfin" = {
+          enable = true;
+          hideMounts = true;
+          directories = [
+            "/var/lib/jellyfin"
+            "/var/cache/jellyfin"
+          ];
+        };
+
+        host.storage.pool.extraDatasets = [
+          {
+            # sops age key needs to be available to pre persist for user generation
+            "persist/system/jellyfin" = {
+              type = "zfs_fs";
+              mountpoint = "/persist/system/jellyfin";
+              options = {
+                atime = "off";
+                relatime = "off";
+                canmount = "on";
+              };
+            };
+          }
+        ];
+      })
+    ]
+  );
+}