Merge pull request #277220 from nu-nu-ko/nixos-jellyfin-dirs (2d627a2a) · Commits · nix / nixpkgs

maintainers/maintainer-list.nix

+6 −0

Original line number	Diff line number	Diff line
		@@ -14042,6 +14042,12 @@
		github = "numkem";
		githubId = 332423;
		};
		nu-nu-ko = {
		email = "host@nuko.city";
		github = "nu-nu-ko";
		githubId = 153512689;
		name = "nuko";
		};
		nviets = {
		email = "nathan.g.viets@gmail.com";
		github = "nviets";

nixos/modules/services/misc/jellyfin.nix

+115 −75

Original line number	Diff line number	Diff line
		{ config, pkgs, lib, ... }:

		with lib;

		let
		inherit (lib) mkIf getExe maintainers mkEnableOption mkOption mkPackageOption;
		inherit (lib.types) str path bool;
		cfg = config.services.jellyfin;
		in
		{
		options = {
		services.jellyfin = {
		enable = mkEnableOption (lib.mdDoc "Jellyfin Media Server");
		enable = mkEnableOption "Jellyfin Media Server";

		package = mkPackageOption pkgs "jellyfin" { };

		user = mkOption {
		type = types.str;
		type = str;
		default = "jellyfin";
		description = lib.mdDoc "User account under which Jellyfin runs.";
		description = "User account under which Jellyfin runs.";
		};

		package = mkPackageOption pkgs "jellyfin" { };

		group = mkOption {
		type = types.str;
		type = str;
		default = "jellyfin";
		description = lib.mdDoc "Group under which jellyfin runs.";
		description = "Group under which jellyfin runs.";
		};

		dataDir = mkOption {
		type = path;
		default = "/var/lib/jellyfin";
		description = ''
		Base data directory,
		passed with `--datadir` see [#data-directory](https://jellyfin.org/docs/general/administration/configuration/#data-directory)
		'';
		};

		configDir = mkOption {
		type = path;
		default = "${cfg.dataDir}/config";
		defaultText = "\${cfg.dataDir}/config";
		description = ''
		Directory containing the server configuration files,
		passed with `--configdir` see [configuration-directory](https://jellyfin.org/docs/general/administration/configuration/#configuration-directory)
		'';
		};

		cacheDir = mkOption {
		type = path;
		default = "/var/cache/jellyfin";
		description = ''
		Directory containing the jellyfin server cache,
		passed with `--cachedir` see [#cache-directory](https://jellyfin.org/docs/general/administration/configuration/#cache-directory)
		'';
		};

		logDir = mkOption {
		type = path;
		default = "${cfg.dataDir}/log";
		defaultText = "\${cfg.dataDir}/log";
		description = ''
		Directory where the Jellyfin logs will be stored,
		passed with `--logdir` see [#log-directory](https://jellyfin.org/docs/general/administration/configuration/#log-directory)
		'';
		};

		openFirewall = mkOption {
		type = types.bool;
		type = bool;
		default = false;
		description = lib.mdDoc ''
		description = ''
		Open the default ports in the firewall for the media server. The
		HTTP/HTTPS ports can be changed in the Web UI, so this option should
		only be used if they are unchanged.
		only be used if they are unchanged, see [Port Bindings](https://jellyfin.org/docs/general/networking/#port-bindings).
		'';
		};
		};
		};

		config = mkIf cfg.enable {
		systemd.services.jellyfin = {
		systemd = {
		tmpfiles.settings.jellyfinDirs = {
		"${cfg.dataDir}"."d" = {
		mode = "700";
		inherit (cfg) user group;
		};
		"${cfg.configDir}"."d" = {
		mode = "700";
		inherit (cfg) user group;
		};
		"${cfg.logDir}"."d" = {
		mode = "700";
		inherit (cfg) user group;
		};
		"${cfg.cacheDir}"."d" = {
		mode = "700";
		inherit (cfg) user group;
		};
		};
		services.jellyfin = {
		description = "Jellyfin Media Server";
		after = [ "network-online.target" ];
		wants = [ "network-online.target" ];
		@@ -45,17 +102,13 @@ in

		# This is mostly follows: https://github.com/jellyfin/jellyfin/blob/master/fedora/jellyfin.service
		# Upstream also disable some hardenings when running in LXC, we do the same with the isContainer option
		serviceConfig = rec {
		serviceConfig = {
		Type = "simple";
		User = cfg.user;
		Group = cfg.group;
		StateDirectory = "jellyfin";
		StateDirectoryMode = "0700";
		CacheDirectory = "jellyfin";
		CacheDirectoryMode = "0700";
		UMask = "0077";
		WorkingDirectory = "/var/lib/jellyfin";
		ExecStart = "${cfg.package}/bin/jellyfin --datadir '/var/lib/${StateDirectory}' --cachedir '/var/cache/${CacheDirectory}'";
		WorkingDirectory = cfg.dataDir;
		ExecStart = "${getExe cfg.package} --datadir '${cfg.dataDir}' --configdir '${cfg.configDir}' --cachedir '${cfg.cacheDir}' --logdir '${cfg.logDir}'";
		Restart = "on-failure";
		TimeoutSec = 15;
		SuccessExitStatus = ["0" "143"];
		@@ -81,29 +134,16 @@ in
		RemoveIPC = true;

		SystemCallFilter = [
		"~@clock"
		"~@aio"
		"~@chown"
		"~@cpu-emulation"
		"~@debug"
		"~@keyring"
		"~@memlock"
		"~@module"
		"~@mount"
		"~@obsolete"
		"~@privileged"
		"~@raw-io"
		"~@reboot"
		"~@setuid"
		"~@swap"
		"~@clock" "~@aio" "~@chown" "~@cpu-emulation" "~@debug" "~@keyring" "~@memlock" "~@module" "~@mount" "~@obsolete" "~@privileged" "~@raw-io" "~@reboot" "~@setuid" "~@swap"
		];
		SystemCallErrorNumber = "EPERM";
		};
		};
		};

		users.users = mkIf (cfg.user == "jellyfin") {
		jellyfin = {
		group = cfg.group;
		inherit (cfg) group;
		isSystemUser = true;
		};
		};
		@@ -120,5 +160,5 @@ in

		};

		meta.maintainers = with lib.maintainers; [ minijackson ];
		meta.maintainers = with maintainers; [ minijackson nu-nu-ko ];
		}

pkgs/servers/jellyfin/default.nix

+1 −0

Original line number	Diff line number	Diff line
		@@ -63,6 +63,7 @@ buildDotnetModule rec {
		# https://github.com/jellyfin/jellyfin/issues/610#issuecomment-537625510
		license = licenses.gpl2Plus;
		maintainers = with maintainers; [ nyanloutre minijackson purcell jojosch ];
		mainProgram = "jellyfin";
		platforms = dotnet-runtime.meta.platforms;
		};
		}

Admin message