{ config, lib, pkgs, ... }:
{
  services.jellyfin.enable = true;
  services.jellyfin.openFirewall = false;
  users.groups."syncthing".members = [ "jellyfin" ];
  hardware.opengl = {
    enable = true;
    driSupport = true;
    driSupport32Bit = true;
  };
  services.nginx = {
    enable = true;
    virtualHosts. "flix.ingolf-wagner.de" = {
      forceSSL = true;
      enableACME = true;
      extraConfig = ''
        # Security / XSS Mitigation Headers
        # NOTE: X-Frame-Options may cause issues with the webOS app
        add_header X-Frame-Options "SAMEORIGIN";
        add_header X-XSS-Protection "1; mode=block";
        add_header X-Content-Type-Options "nosniff";
      '';
      locations."/" = {
        recommendedProxySettings = true;
        proxyWebsockets = true;
        proxyPass = "http://localhost:8096";
      };
    };
  };
}