Lets per-host configs (NixOS containers) disable backup-client,
outgoing-server-mail, and telegraf with a plain assignment.

@@ -5,0 +4,4 @@
+  qois.backup-client.includePaths = [
+    "/mnt/data"
+    "/var/lib/jellyfin"
+    "/var/lib/nixos-containers"

@@ -49,1 +50,3 @@
-    internalInterfaces = [ "vms-nat" ];
+    internalInterfaces = [
+      "vms-nat"
+      "ve-jellyfin"

@@ -63,6 +68,11 @@ in
     allowedTCPPorts = [ 53 ];
   };
 
+  networking.firewall.interfaces."ve-jellyfin" = {

@@ -0,0 +1,63 @@
+# Jellyfin
+
+Jellyfin media server running as a NixOS container (systemd-nspawn) on `lindberg`, configured via [nixflix](https://kiriwalawren.github.io/nixflix/reference/).

@@ -0,0 +32,4 @@
+Before deploying, create both secrets on lindberg:
+
+```bash
+sops private/nixos-configurations/lindberg/secrets.sops.yaml

@@ -0,0 +34,4 @@
+    # Admin user: password is read at runtime from /run/jellyfin-admin-password,
+    # which is materialized by jellyfin-credential-setup.service below.
+    nixflix.jellyfin.users.admin = {
+      password._secret = "/run/jellyfin-admin-password";

@@ -0,0 +64,4 @@
+    };
+
+    # API key read from systemd credential passed by the container host via --load-credential.
+    # Create: sops private/nixos-configurations/lindberg/secrets.sops.yaml

@@ -0,0 +73,4 @@
+      "jellyfin-api-key:jellyfin-api-key"
+    ];
+
+    # Reverse proxy via nixflix's nginx module: it builds the virtual host

@@ -0,0 +76,4 @@
+    # Reverse proxy via nixflix's nginx module: it builds the virtual host
+    # "${subdomain}.${domain}" with proxyPass, websockets, buffering off, and
+    # forceSSL via mkVirtualHost, and auto-derives knownProxies/localNetworkAddresses.
+    # We layer per-host ACME (instead of nixflix's wildcard useACMEHost pattern) and kTLS on top.

@@ -0,0 +39,4 @@
+        sslCertificateKey = "${certs}/${jellyfinDomain}.key.pem";
+      };
+
+      networking.extraHosts = "127.0.0.1 ${jellyfinDomain}";

@@ -99,2 +114,4 @@
     };
 
+    containerDomains = mkOption {
+      description = "Full domain to container-name mappings; IPs taken from lindberg-containers-nat network";