add nginx proxy to jellyfin

bundles/jellyfin/metadata.py

@@ -13,6 +13,11 @@ defaults = {
             },
         },
     },
+    'backups': {
+        'paths': {
+            f'/var/lib/jellyfin/{x}' for x in ('data', 'metadata', 'plugins', 'root')
+        },
+    },
     'icinga2_api': {
         'transmission': {
             'services': {
@@ -26,13 +31,27 @@ defaults = {
 
 
 @metadata_reactor.provides(
-    'firewall/port_rules',
+    'nginx/vhosts/jellyfin',
 )
-def firewall(metadata):
+def nginx(metadata):
+    if not node.has_bundle('nginx'):
+        raise DoNotRunAgain
+
+    if 'jellyfin' not in metadata.get('nginx/vhosts', {}):
+        return {}
+
     return {
-        'firewall': {
+        'nginx': {
-            'port_rules': {
+            'vhosts': {
-                '8096': atomic(metadata.get('jellyfin/restrict-to', {'*'})),
+                'jellyfin': {
+                    'do_not_add_content_security_headers': True,
+                    'locations': {
+                        '/': {
+                            'target': 'http://127.0.0.1:8096',
+                            'websockets': True,
+                        },
+                    },
+                },
             },
         },
     }

data/powerdns/files/bind-zones/kunbox.net

@@ -27,6 +27,9 @@ _acme-challenge.home IN CNAME   _acme-challenge.home.kunbox.net.le.kunbox.net.
 ; aurto, keep old name
 aurto               IN  CNAME   aurto.htz-cloud
 
+; stuff running at home
+jellyfin.home       IN  CNAME   nas.home
+
 ; Mail servers
 mta-sts             IN  CNAME   carlene
 

nodes/home/nas.py

@@ -17,6 +17,7 @@ nodes['home.nas'] = {
     },
     'groups': {
         'debian-bullseye',
+        'webserver',
     },
     'metadata': {
         'interfaces': {
@@ -135,6 +136,14 @@ nodes['home.nas'] = {
                 },
             },
         },
+        'nginx': {
+            'vhosts': {
+                'jellyfin': {
+                    'domain': 'jellyfin.home.kunbox.net',
+                    'ssl': '_.home.kunbox.net',
+                },
+            },
+        },
         'rsyslogd': {
             'restrict-to': {
                 'home',