nixos-config/machines/orbi/media-jellyfin.nix

{
  config,
  lib,
  pkgs,
  ...
}:
{

  services.jellyfin = {
    enable = true;
    openFirewall = true;
    group = "media";
    user = "media";
  };

  hardware.graphics.enable = true;
  hardware.graphics.enable32Bit = true;

  services.nginx =
    let
      flixConfig = {
        forceSSL = true;
        enableACME = true;
        extraConfig = ''
          # Security / XSS Mitigation Headers
          # NOTE: X-Frame-Options may cause issues with the webOS app
          add_header X-Frame-Options "SAMEORIGIN";
          add_header X-XSS-Protection "1; mode=block";
          add_header X-Content-Type-Options "nosniff";
        '';
        locations."/" = {
          recommendedProxySettings = true;
          proxyWebsockets = true;
          proxyPass = "http://localhost:8096";
        };
      };
    in
    {
      enable = true;
      virtualHosts."flix.ingolf-wagner.de" = flixConfig;
    };
}