sagittarius: set up jellyfin nginx forwarding

1 files changed, 53 insertions, 2 deletions

diff --git a/hosts/sagittarius/web/jellyfin.nix b/hosts/sagittarius/web/jellyfin.nix
index cea5f69..9f0efa5 100644
--- a/hosts/sagittarius/web/jellyfin.nix
+++ b/hosts/sagittarius/web/jellyfin.nix
@@ -1,7 +1,58 @@
 { ... }:
 {
-  services.jellyfin = {
+  imports = [ ./acme.nix ];
+  services.jellyfin.enable = true;
+
+  services.nginx = {
     enable = true;
-    openFirewall = true;
+    virtualHosts."jellyfin.sorre.xyz" = {
+      forceSSL = true;
+      forceACME = true;
+
+      # NOTE: These are the default ports, don't change them in the web UI or
+      # the nginx config will break
+      locations = {
+        "/" = {
+          proxyPass = "http://localhost:8096";
+          recommendedProxySettings = true;
+          extraConfig = ''
+            # Disable buffering when the nginx proxy gets very resource heavy
+            # upon streaming
+            proxy_buffering off;
+          '';
+        };
+
+        # Proxy Jellyfin Websockets traffic
+        "/socket" = {
+          proxyPass = "http://localhost:8096";
+          recommendedProxySettings = true;
+        };
+      };
+
+      extraConfig = ''
+        # The default `client_max_body_size` is 1M, this might not be enough
+        # for some posters, etc.
+        client_max_body_size 20M;
+
+        # NOTE: X-Frame-Options may cause issues with the webOS app
+        add_header X-Frame-Options "SAMEORIGIN";
+        add_header X-Content-Type-Options "nosniff";
+
+        # COOP/COEP. Disable if you use external plugins/images/assets
+        add_header Cross-Origin-Opener-Policy "same-origin" always;
+        add_header Cross-Origin-Embedder-Policy "require-corp" always;
+        add_header Cross-Origin-Resource-Policy "same-origin" always;
+
+        # Permissions policy. May cause issues on some clients
+        add_header Permissions-Policy "accelerometer=(), ambient-light-sensor=(), battery=(), bluetooth=(), camera=(), clipboard-read=(), display-capture=(), document-domain=(), encrypted-media=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), payment=(), publickey-credentials-get=(), serial=(), sync-xhr=(), usb=(), xr-spatial-tracking=()" always;
+
+        # Content Security Policy
+        # See: https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP
+        # Enforces https content and restricts JS/CSS to origin
+        # External Javascript (such as cast_sender.js for Chromecast) must be whitelisted.
+        # NOTE: The default CSP headers may cause issues with the webOS app
+        add_header Content-Security-Policy "default-src https: data: blob: http://image.tmdb.org; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' https://www.gstatic.com https://www.youtube.com blob:; worker-src 'self' blob:; connect-src 'self'; object-src 'none'; frame-ancestors 'self'";
+      '';
+    };
   };
 }