Simon Gardling
735603deb8
All checks were successful
Build and Deploy / deploy (push) Successful in 2m41s
48 lines
1.2 KiB
Nix
48 lines
1.2 KiB
Nix
{
|
|
pkgs,
|
|
config,
|
|
service_configs,
|
|
lib,
|
|
...
|
|
}:
|
|
lib.mkIf config.services.jellyfin.enable {
|
|
systemd.services."jellyfin-set-defaults" = {
|
|
description = "Enforce default Jellyfin user preferences (fMP4-HLS)";
|
|
after = [ "jellyfin.service" ];
|
|
requires = [ "jellyfin.service" ];
|
|
|
|
serviceConfig = {
|
|
Type = "oneshot";
|
|
ExecStart = "${pkgs.python3}/bin/python ${./jellyfin-set-defaults.py}";
|
|
|
|
# Security hardening
|
|
DynamicUser = true;
|
|
NoNewPrivileges = true;
|
|
ProtectSystem = "strict";
|
|
ProtectHome = true;
|
|
ProtectKernelTunables = true;
|
|
ProtectKernelModules = true;
|
|
ProtectControlGroups = true;
|
|
MemoryDenyWriteExecute = true;
|
|
RestrictRealtime = true;
|
|
RestrictSUIDSGID = true;
|
|
RemoveIPC = true;
|
|
|
|
LoadCredential = "jellyfin-api-key:${config.age.secrets.jellyfin-api-key.path}";
|
|
};
|
|
|
|
environment = {
|
|
JELLYFIN_URL = "http://127.0.0.1:${toString service_configs.ports.private.jellyfin.port}";
|
|
};
|
|
};
|
|
|
|
# Run at boot and daily to catch newly created users
|
|
systemd.timers."jellyfin-set-defaults" = {
|
|
wantedBy = [ "timers.target" ];
|
|
timerConfig = {
|
|
OnBootSec = "2min";
|
|
OnUnitActiveSec = "1d";
|
|
};
|
|
};
|
|
}
|