nix-config/modules/nixos-modules/server/jellyfin.nix

{
  lib,
  pkgs,
  config,
  ...
}: let
  jellyfinPort = 8096;
  jellyfin_data_directory = "/var/lib/jellyfin";
  jellyfin_cache_directory = "/var/cache/jellyfin";
  jellyfin_media_directory = "/srv/jellyfin/media";
in {
  options.host.jellyfin = {
    enable = lib.mkEnableOption "should jellyfin be enabled on this computer";
    subdomain = lib.mkOption {
      type = lib.types.str;
      description = "subdomain of base domain that jellyfin will be hosted at";
      default = "jellyfin";
    };
    extraSubdomains = lib.mkOption {
      type = lib.types.listOf lib.types.str;
      description = "ex subdomain of base domain that jellyfin will be hosted at";
      default = [];
    };
  };

  config = lib.mkIf config.host.jellyfin.enable (
    lib.mkMerge [
      {
        services.jellyfin.enable = true;
        host.reverse_proxy.subdomains = lib.mkMerge ([
            {
              ${config.host.jellyfin.subdomain} = {
                target = "http://localhost:${toString jellyfinPort}";
                extraConfig = ''
                  client_max_body_size 20M;
                  add_header X-Content-Type-Options "nosniff";
                  add_header Content-Security-Policy "default-src https: data: blob: ; img-src 'self' https://* ; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' https://www.gstatic.com https://www.youtube.com blob:; worker-src 'self' blob:; connect-src 'self'; object-src 'none'; frame-ancestors 'self'; font-src 'self'";
                  add_header Permissions-Policy "accelerometer=(), ambient-light-sensor=(), battery=(), bluetooth=(), camera=(), clipboard-read=(), display-capture=(), document-domain=(), encrypted-media=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), payment=(), publickey-credentials-get=(), serial=(), sync-xhr=(), usb=(), xr-spatial-tracking=()" always;

                  proxy_set_header Host $host;
                  proxy_set_header X-Real-IP $remote_addr;
                  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                  proxy_set_header X-Forwarded-Proto $scheme;
                  proxy_set_header X-Forwarded-Protocol $scheme;
                  proxy_set_header X-Forwarded-Host $http_host;

                  proxy_buffering off;
                '';
              };
            }
          ]
          ++ (builtins.map (subdomain: {
              ${subdomain} = {
                target = "http://localhost:${toString jellyfinPort}";
                extraConfig = ''
                  client_max_body_size 20M;
                  add_header X-Content-Type-Options "nosniff";
                  add_header Content-Security-Policy "default-src https: data: blob: ; img-src 'self' https://* ; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' https://www.gstatic.com https://www.youtube.com blob:; worker-src 'self' blob:; connect-src 'self'; object-src 'none'; frame-ancestors 'self'; font-src 'self'";
                  add_header Permissions-Policy "accelerometer=(), ambient-light-sensor=(), battery=(), bluetooth=(), camera=(), clipboard-read=(), display-capture=(), document-domain=(), encrypted-media=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), payment=(), publickey-credentials-get=(), serial=(), sync-xhr=(), usb=(), xr-spatial-tracking=()" always;

                  proxy_set_header Host $host;
                  proxy_set_header X-Real-IP $remote_addr;
                  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                  proxy_set_header X-Forwarded-Proto $scheme;
                  proxy_set_header X-Forwarded-Protocol $scheme;
                  proxy_set_header X-Forwarded-Host $http_host;

                  proxy_buffering off;
                '';
              };
            })
            config.host.jellyfin.extraSubdomains));
        environment.systemPackages = [
          pkgs.jellyfin
          pkgs.jellyfin-web
          pkgs.jellyfin-ffmpeg
        ];
      }
      (lib.mkIf config.host.impermanence.enable {
        fileSystems."/persist/system/jellyfin".neededForBoot = true;

        host.storage.pool.extraDatasets = {
          # sops age key needs to be available to pre persist for user generation
          "persist/system/jellyfin" = {
            type = "zfs_fs";
            mountpoint = "/persist/system/jellyfin";
            options = {
              atime = "off";
              relatime = "off";
              canmount = "on";
            };
          };
        };

        assertions = [
          {
            assertion = config.services.jellyfin.dataDir == jellyfin_data_directory;
            message = "jellyfin data directory does not match persistence";
          }
          {
            assertion = config.services.jellyfin.cacheDir == jellyfin_cache_directory;
            message = "jellyfin cache directory does not match persistence";
          }
        ];

        environment.persistence = {
          "/persist/system/root" = {
            enable = true;
            hideMounts = true;
            directories = [
              {
                directory = jellyfin_data_directory;
                user = "jellyfin";
                group = "jellyfin";
              }
              {
                directory = jellyfin_cache_directory;
                user = "jellyfin";
                group = "jellyfin";
              }
            ];
          };

          "/persist/system/jellyfin" = {
            enable = true;
            hideMounts = true;
            directories = [
              {
                directory = jellyfin_media_directory;
                user = "jellyfin";
                group = "jellyfin_media";
                mode = "1770";
              }
            ];
          };
        };
      })
    ]
  );
}