1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
|
{ ... }:
{
imports = [ ./acme.nix ];
services.jellyfin.enable = true;
services.nginx = {
enable = true;
virtualHosts."jellyfin.sorre.xyz" = {
forceSSL = true;
forceACME = true;
# NOTE: These are the default ports, don't change them in the web UI or
# the nginx config will break
locations = {
"/" = {
proxyPass = "http://localhost:8096";
recommendedProxySettings = true;
extraConfig = ''
# Disable buffering when the nginx proxy gets very resource heavy
# upon streaming
proxy_buffering off;
'';
};
# Proxy Jellyfin Websockets traffic
"/socket" = {
proxyPass = "http://localhost:8096";
recommendedProxySettings = true;
};
};
extraConfig = ''
# The default `client_max_body_size` is 1M, this might not be enough
# for some posters, etc.
client_max_body_size 20M;
# NOTE: X-Frame-Options may cause issues with the webOS app
add_header X-Frame-Options "SAMEORIGIN";
add_header X-Content-Type-Options "nosniff";
# COOP/COEP. Disable if you use external plugins/images/assets
add_header Cross-Origin-Opener-Policy "same-origin" always;
add_header Cross-Origin-Embedder-Policy "require-corp" always;
add_header Cross-Origin-Resource-Policy "same-origin" always;
# Permissions policy. May cause issues on some clients
add_header Permissions-Policy "accelerometer=(), ambient-light-sensor=(), battery=(), bluetooth=(), camera=(), clipboard-read=(), display-capture=(), document-domain=(), encrypted-media=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), payment=(), publickey-credentials-get=(), serial=(), sync-xhr=(), usb=(), xr-spatial-tracking=()" always;
# Content Security Policy
# See: https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP
# Enforces https content and restricts JS/CSS to origin
# External Javascript (such as cast_sender.js for Chromecast) must be whitelisted.
# NOTE: The default CSP headers may cause issues with the webOS app
add_header Content-Security-Policy "default-src https: data: blob: http://image.tmdb.org; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' https://www.gstatic.com https://www.youtube.com blob:; worker-src 'self' blob:; connect-src 'self'; object-src 'none'; frame-ancestors 'self'";
'';
};
};
}
|
