Include jellyfin provisioning

templates/jellyfin/docker-compose.j2

@@ -0,0 +1,44 @@
+# {{ ansible_managed }}
+#
+
+networks:
+  jellyfin-net:
+    ipam:
+      config:
+        - subnet: '{{ jellyfin_subnet }}'
+
+services:
+  jellyfin:
+    image: {{ jellyfin_image_tag }}
+    container_name: jellyfin
+    user: {{ ansible_user_uid }}:{{ ansible_user_gid }}
+    group_add:
+      - 44 # video group
+      - 105 # render group
+    volumes:
+      - {{ jellyfin_configuration_dir }}:/config
+      - {{ jellyfin_cache_dir }}:/cache
+      - type: bind
+        source: {{ jellyfin_media_dir }}
+        target: /media
+      - /etc/passwd:/etc/passwd:ro
+      - /etc/group:/etc/group:ro
+    restart: always
+    networks:
+      jellyfin-net:
+    expose:
+      - {{ jellyfin_web_port }}/tcp
+    devices:
+      - /dev/dri/renderD128:/dev/dri/renderD128
+      - /dev/dri/card0:/dev/dri/card0
+
+  nginx:
+    image: nginx:mainline-alpine
+    depends_on:
+      - jellyfin
+    restart: always
+    networks:
+      jellyfin-net:
+        ipv4_address: '{{ jellyfin_nginx_ip }}'
+    volumes:
+      - '{{ jellyfin_app_dir }}/nginx.conf.d:/etc/nginx/conf.d'

templates/jellyfin/nginx.j2

@@ -0,0 +1,57 @@
+# {{ ansible_managed }}
+
+upstream jellyfin-upstream {
+    server jellyfin:{{ jellyfin_web_port }};
+}
+
+server {
+  listen 80;
+  server_name {{ jellyfin_domain }};
+  http2 on;
+
+  ## The default `client_max_body_size` is 1M, this might not be enough for some posters, etc.
+  client_max_body_size 20M;
+
+  # Comment next line to allow TLSv1.0 and TLSv1.1 if you have very old clients
+  ssl_protocols TLSv1.3 TLSv1.2;
+
+  # Security / XSS Mitigation Headers
+  add_header X-Content-Type-Options "nosniff";
+
+  # Permissions policy. May cause issues with some clients
+  add_header Permissions-Policy "accelerometer=(), ambient-light-sensor=(), battery=(), bluetooth=(), camera=(), clipboard-read=(), display-capture=(), document-domain=(), encrypted-media=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), payment=(), publickey-credentials-get=(), serial=(), sync-xhr=(), usb=(), xr-spatial-tracking=()" always;
+
+  # Content Security Policy
+  # See: https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP
+  # Enforces https content and restricts JS/CSS to origin
+  # External Javascript (such as cast_sender.js for Chromecast) must be whitelisted.
+  add_header Content-Security-Policy "default-src http: data: blob: ; img-src 'self' http://* ; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' https://www.gstatic.com https://www.youtube.com blob:; worker-src 'self' blob:; connect-src 'self'; object-src 'none'; frame-ancestors 'self'; font-src 'self'";
+
+  location / {
+    # Proxy main Jellyfin traffic
+    proxy_pass http://jellyfin-upstream;
+    proxy_set_header Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;
+    proxy_set_header X-Forwarded-Protocol $scheme;
+    proxy_set_header X-Forwarded-Host $http_host;
+
+    # Disable buffering when the nginx proxy gets very resource heavy upon streaming
+    proxy_buffering off;
+  }
+
+  location /socket {
+    # Proxy Jellyfin Websockets traffic
+    proxy_pass http://jellyfin-upstream;
+    proxy_http_version 1.1;
+    proxy_set_header Upgrade $http_upgrade;
+    proxy_set_header Connection "upgrade";
+    proxy_set_header Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;
+    proxy_set_header X-Forwarded-Protocol $scheme;
+    proxy_set_header X-Forwarded-Host $http_host;
+  }
+}

templates/network/hosts.j2

@@ -8,3 +8,4 @@
 {{ transmission_nginx_ip }}       {{ transmission_domain }}
 {{ syncthing_nginx_ip }}          {{ syncthing_domain }}
 {{ radicale_nginx_ip }}           {{ radicale_domain }}
+{{ jellyfin_nginx_ip }}           {{ jellyfin_domain }}

templates/nftables.j2

@@ -52,7 +52,7 @@ table ip filter {
   chain vpn_chain {
     meta l4proto { tcp, udp } th dport 53 ip saddr . ip daddr @vpn_set accept comment "DNS"
 
-    tcp dport { {{ http_port }}, {{ https_port }} } ip saddr . ip daddr @vpn_set accept comment "HTTP/HTTPS"
+    tcp dport { {{ http_port }}, {{ https_port }} } ip saddr . ip daddr @vpn_set accept comment "HTTP/HTTPS" # TODO: remove?
 
     tcp dport 80 ip saddr {{ vpn_subnet }} ip daddr {{ transmission_nginx_ip }} accept comment "Transmission Web"
 
@@ -75,7 +75,7 @@ table ip filter {
   chain media_vpn_chain {
     meta l4proto { tcp, udp } th dport 53 ip saddr . ip daddr @vpn_media_set accept comment "DNS"
 
-    tcp dport {{ jellyfin_http_port }} ip saddr . ip daddr @vpn_media_set accept comment "Jellyfin HTTP"
+    tcp dport { 80, 443 } ip saddr {{ vpn_media_subnet }} ip daddr {{ jellyfin_nginx_ip }} accept comment "Jellyfin"
   }
 
   # docker's user configurable forward hook chain
@@ -83,5 +83,7 @@ table ip filter {
     iifname {{ vpn_interface }} ip saddr {{ vpn_subnet }} ip daddr {{ transmission_nginx_ip }} accept
     iifname {{ vpn_interface }} ip saddr {{ vpn_subnet }} ip daddr {{ syncthing_nginx_ip }} accept
     iifname {{ vpn_interface }} ip saddr {{ vpn_subnet }} ip daddr {{ radicale_nginx_ip }} accept
+
+    iifname {{ vpn_media_interface }} ip saddr {{ vpn_media_subnet }} ip daddr {{ jellyfin_nginx_ip }} accept
   }
 }