jellyfin: setup service

hosts/poseidon/default.nix

@@ -85,6 +85,10 @@ in
       privatePort = 8082;
     };
 
+    jellyfin = {
+      enable = true;
+    };
+
     miniflux = {
       enable = true;
       adminCredentialsFile = "${../../secrets/miniflux-admin-credentials.secret}";

services/default.nix

@@ -5,7 +5,9 @@
     ./bitwarden_rs.nix
     ./borg-backup.nix
     ./gitea.nix
+    ./jellyfin.nix
     ./matrix.nix
+    ./media.nix
     ./miniflux.nix
     ./monitoring.nix
     ./nginx.nix

services/jellyfin.nix

@@ -0,0 +1,32 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.my.services.jellyfin;
+  my = config.my;
+
+  domain = config.networking.domain;
+
+  # hardcoded in NixOS module :(
+  jellyfinPort = 8096;
+in {
+  options.my.services.jellyfin = {
+    enable = mkEnableOption "Jellyfin";
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.jellyfin = {
+      enable = true;
+      group = "media";
+    };
+
+    # Proxy to Jellyfin
+    services.nginx.virtualHosts."jellyfin.${domain}" = {
+      forceSSL = true;
+      enableACME = true;
+
+      locations."/".proxyPass = "http://localhost:${toString jellyfinPort}/";
+    };
+  };
+}

services/media.nix

@@ -0,0 +1,10 @@
+{ config, lib, ... }:
+let
+  mediaServices = with config.my.services; [
+    jellyfin
+  ];
+  needed = builtins.any (service: service.enable) mediaServices;
+in
+{
+  config.users.groups.media = lib.mkIf needed { };
+}