diff options
| -rw-r--r-- | hosts/sagittarius/web/jellyfin.nix | 55 |
1 files changed, 53 insertions, 2 deletions
diff --git a/hosts/sagittarius/web/jellyfin.nix b/hosts/sagittarius/web/jellyfin.nix index cea5f69..9f0efa5 100644 --- a/hosts/sagittarius/web/jellyfin.nix +++ b/hosts/sagittarius/web/jellyfin.nix @@ -1,7 +1,58 @@ { ... }: { - services.jellyfin = { + imports = [ ./acme.nix ]; + services.jellyfin.enable = true; + + services.nginx = { enable = true; - openFirewall = true; + virtualHosts."jellyfin.sorre.xyz" = { + forceSSL = true; + forceACME = true; + + # NOTE: These are the default ports, don't change them in the web UI or + # the nginx config will break + locations = { + "/" = { + proxyPass = "http://localhost:8096"; + recommendedProxySettings = true; + extraConfig = '' + # Disable buffering when the nginx proxy gets very resource heavy + # upon streaming + proxy_buffering off; + ''; + }; + + # Proxy Jellyfin Websockets traffic + "/socket" = { + proxyPass = "http://localhost:8096"; + recommendedProxySettings = true; + }; + }; + + extraConfig = '' + # The default `client_max_body_size` is 1M, this might not be enough + # for some posters, etc. + client_max_body_size 20M; + + # NOTE: X-Frame-Options may cause issues with the webOS app + add_header X-Frame-Options "SAMEORIGIN"; + add_header X-Content-Type-Options "nosniff"; + + # COOP/COEP. Disable if you use external plugins/images/assets + add_header Cross-Origin-Opener-Policy "same-origin" always; + add_header Cross-Origin-Embedder-Policy "require-corp" always; + add_header Cross-Origin-Resource-Policy "same-origin" always; + + # Permissions policy. May cause issues on some clients + add_header Permissions-Policy "accelerometer=(), ambient-light-sensor=(), battery=(), bluetooth=(), camera=(), clipboard-read=(), display-capture=(), document-domain=(), encrypted-media=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), payment=(), publickey-credentials-get=(), serial=(), sync-xhr=(), usb=(), xr-spatial-tracking=()" always; + + # Content Security Policy + # See: https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP + # Enforces https content and restricts JS/CSS to origin + # External Javascript (such as cast_sender.js for Chromecast) must be whitelisted. + # NOTE: The default CSP headers may cause issues with the webOS app + add_header Content-Security-Policy "default-src https: data: blob: http://image.tmdb.org; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' https://www.gstatic.com https://www.youtube.com blob:; worker-src 'self' blob:; connect-src 'self'; object-src 'none'; frame-ancestors 'self'"; + ''; + }; }; } |