Include jellyfin provisioning

templates/jellyfin/docker-compose.j2

@@ -0,0 +1,44 @@
+# {{ ansible_managed }}
+#
+
+networks:
+  jellyfin-net:
+    ipam:
+      config:
+        - subnet: '{{ jellyfin_subnet }}'
+
+services:
+  jellyfin:
+    image: {{ jellyfin_image_tag }}
+    container_name: jellyfin
+    user: {{ ansible_user_uid }}:{{ ansible_user_gid }}
+    group_add:
+      - 44 # video group
+      - 105 # render group
+    volumes:
+      - {{ jellyfin_configuration_dir }}:/config
+      - {{ jellyfin_cache_dir }}:/cache
+      - type: bind
+        source: {{ jellyfin_media_dir }}
+        target: /media
+      - /etc/passwd:/etc/passwd:ro
+      - /etc/group:/etc/group:ro
+    restart: always
+    networks:
+      jellyfin-net:
+    expose:
+      - {{ jellyfin_web_port }}/tcp
+    devices:
+      - /dev/dri/renderD128:/dev/dri/renderD128
+      - /dev/dri/card0:/dev/dri/card0
+
+  nginx:
+    image: nginx:mainline-alpine
+    depends_on:
+      - jellyfin
+    restart: always
+    networks:
+      jellyfin-net:
+        ipv4_address: '{{ jellyfin_nginx_ip }}'
+    volumes:
+      - '{{ jellyfin_app_dir }}/nginx.conf.d:/etc/nginx/conf.d'

templates/jellyfin/nginx.j2

@@ -0,0 +1,57 @@
+# {{ ansible_managed }}
+
+upstream jellyfin-upstream {
+    server jellyfin:{{ jellyfin_web_port }};
+}
+
+server {
+  listen 80;
+  server_name {{ jellyfin_domain }};
+  http2 on;
+
+  ## The default `client_max_body_size` is 1M, this might not be enough for some posters, etc.
+  client_max_body_size 20M;
+
+  # Comment next line to allow TLSv1.0 and TLSv1.1 if you have very old clients
+  ssl_protocols TLSv1.3 TLSv1.2;
+
+  # Security / XSS Mitigation Headers
+  add_header X-Content-Type-Options "nosniff";
+
+  # Permissions policy. May cause issues with some clients
+  add_header Permissions-Policy "accelerometer=(), ambient-light-sensor=(), battery=(), bluetooth=(), camera=(), clipboard-read=(), display-capture=(), document-domain=(), encrypted-media=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), payment=(), publickey-credentials-get=(), serial=(), sync-xhr=(), usb=(), xr-spatial-tracking=()" always;
+
+  # Content Security Policy
+  # See: https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP
+  # Enforces https content and restricts JS/CSS to origin
+  # External Javascript (such as cast_sender.js for Chromecast) must be whitelisted.
+  add_header Content-Security-Policy "default-src http: data: blob: ; img-src 'self' http://* ; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' https://www.gstatic.com https://www.youtube.com blob:; worker-src 'self' blob:; connect-src 'self'; object-src 'none'; frame-ancestors 'self'; font-src 'self'";
+
+  location / {
+    # Proxy main Jellyfin traffic
+    proxy_pass http://jellyfin-upstream;
+    proxy_set_header Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;
+    proxy_set_header X-Forwarded-Protocol $scheme;
+    proxy_set_header X-Forwarded-Host $http_host;
+
+    # Disable buffering when the nginx proxy gets very resource heavy upon streaming
+    proxy_buffering off;
+  }
+
+  location /socket {
+    # Proxy Jellyfin Websockets traffic
+    proxy_pass http://jellyfin-upstream;
+    proxy_http_version 1.1;
+    proxy_set_header Upgrade $http_upgrade;
+    proxy_set_header Connection "upgrade";
+    proxy_set_header Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;
+    proxy_set_header X-Forwarded-Protocol $scheme;
+    proxy_set_header X-Forwarded-Host $http_host;
+  }
+}