nixos-config/nixos/machines/robi/jellyfin.nix

{ config, lib, pkgs, ... }:
{
  services.jellyfin.enable = true;
  services.jellyfin.openFirewall = false;
  users.groups."syncthing".members = [ "jellyfin" ];
  hardware.opengl = {
    enable = true;
    driSupport = true;
    driSupport32Bit = true;
  };
  services.nginx =
    let
      flixConfig = {
        forceSSL = true;
        enableACME = true;
        extraConfig = ''
          # Security / XSS Mitigation Headers
          # NOTE: X-Frame-Options may cause issues with the webOS app
          add_header X-Frame-Options "SAMEORIGIN";
          add_header X-XSS-Protection "1; mode=block";
          add_header X-Content-Type-Options "nosniff";
        '';
        locations."/" = {
          recommendedProxySettings = true;
          proxyWebsockets = true;
          proxyPass = "http://localhost:8096";
        };
      };
    in
    {
      enable = true;
      virtualHosts. "flix.ingolf-wagner.de" = flixConfig;
      virtualHosts. "video.ingolf-wagner.de" = flixConfig;
    };
}