From 23e9af7564580e678b0e0f0c81ea8aeeca27d110 Mon Sep 17 00:00:00 2001
From: Tim Van Baak <tim.vanbaak@gmail.com>
Date: Sun, 22 Oct 2023 20:56:06 +0000
Subject: [PATCH] backyard: Enable Jellyfin server

---
 machine/backyard/default.nix  |  5 +----
 machine/backyard/jellyfin.nix | 37 +++++++++++++++++++++++++++++++++++
 modules/beatific.nix          |  1 +
 3 files changed, 39 insertions(+), 4 deletions(-)
 create mode 100644 machine/backyard/jellyfin.nix

diff --git a/machine/backyard/default.nix b/machine/backyard/default.nix
index 7b00036..45e7c24 100644
--- a/machine/backyard/default.nix
+++ b/machine/backyard/default.nix
@@ -3,6 +3,7 @@
 {
   imports = [
     ./hardware-configuration.nix
+    ./jellyfin.nix
   ];
 
   boot.loader.grub = {
@@ -18,10 +19,6 @@
 
   networking.firewall = {
     enable = true;
-    allowedTCPPorts = [
-      80  # http
-      443 # https
-    ];
   };
 
   # This value governs how some stateful data, like databases, are handled
diff --git a/machine/backyard/jellyfin.nix b/machine/backyard/jellyfin.nix
new file mode 100644
index 0000000..acd3144
--- /dev/null
+++ b/machine/backyard/jellyfin.nix
@@ -0,0 +1,37 @@
+{ pkgs, ... }:
+
+{
+  # Enable jellyfin
+  services.jellyfin.enable = true;
+
+  services.nginx = {
+    enable = true;
+    recommendedProxySettings = true;
+    virtualHosts = {
+      # Create a default vhost to deny traffic, so traffic has to actually match a vhost
+      default = {
+        default = true;
+        locations."/".return = "444";
+      };
+      "jellyfin" = {
+        listen = [
+          # Available on the local network (host managed by router)
+          { addr = "jellyfin.backyard.lan"; port = 80; }
+          # Available by name on beatific (host managed by beatific module)
+          { addr = "jellyfin.backyard.home"; port = 80; }
+          # Available by port on beatific until I solve DNS for non-NixOS hosts
+          { addr = "10.22.20.8"; port = 8096; }
+        ];
+        locations."/".extraConfig = ''
+          proxy_buffering off;
+          proxy_pass http://localhost:8096/;
+        '';
+      };
+    };
+  };
+
+  networking.firewall.allowedTCPPorts = [
+    80    # http
+    8096  # jellyfin
+  ];
+}
diff --git a/modules/beatific.nix b/modules/beatific.nix
index 91e78ea..d062da3 100644
--- a/modules/beatific.nix
+++ b/modules/beatific.nix
@@ -181,6 +181,7 @@ in {
         ];
         "10.22.20.8" = [
           "backyard.home"
+          "jellyfin.backyard.home"
         ];
       };
     })