Update jellyfin

Signed-off-by: Bensuperpc <bensuperpc@gmail.com>
2024-12-22 00:34:26 +01:00 · 2022-11-27 19:37:45 +01:00 · 2022-11-27 19:37:45 +01:00 · 5299ab2013
commit 5299ab2013
parent 41abf651b9
5 changed files with 115 additions and 103 deletions
--- a/3
+++ b/3
@ -20,7 +20,6 @@

 DOCKER := docker

-DISABLED_PROFILE := firefox
 PROFILE := wp_db wordpress webserver certbot phpmyadmin flask_website flask_db pgadmin qbittorrent jellyfin
 PROFILE_CMD := $(addprefix --profile ,$(PROFILE))

@ -29,7 +28,7 @@ COMPOSE_FILE := docker-compose.yml
 AUTHOR := bensuperpc

 IMAGE_NAME := wordpress:6.1.1-php8.1-fpm mariadb:10.10.2 nginx:1.23 certbot/certbot:v1.32.0 phpmyadmin:5.2.0 dpage/pgadmin4:6.16 lscr.io/linuxserver/qbittorrent:latest \
-		lscr.io/linuxserver/jellyfin:latest firefox:latest lscr.io/linuxserver/firefox:latest
+		lscr.io/linuxserver/jellyfin:latest

 #IMAGE_AUTHOR := $(addprefix itzg/, $(IMAGE_NAME))

--- a/docker-compose.yml
+++ b/docker-compose.yml
@ -122,25 +122,6 @@ services:
    restart: unless-stopped
    networks:
      - app-network
-#  firefox:
-#    image: lscr.io/linuxserver/firefox:latest
-#    container_name: firefox
-#    profiles:
-#      - firefox
-#    security_opt:
-#      - seccomp:unconfined #optional
-#    environment:
-#      - PUID=1000
-#      - PGID=1000
-#      - TZ=Europe/London
-#    volumes:
-#      - firefox-config:/config
-    #ports:
-    #  - 3000:3000
-#    shm_size: "1gb"
-#    restart: unless-stopped
-#    networks:
-#      - app-network
  certbot:
    depends_on:
      - webserver
@ -200,8 +181,6 @@ volumes:
    name: jellyfin-tvseries
  jellyfin-movies:
    name: jellyfin-movies
-  firefox-config:
-    name: firefox-config
  postgres-data:
    name: postgres-data

--- a/nginx-conf/firefox.conf
+++ b/nginx-conf/firefox.conf
@ -1,30 +0,0 @@
-#upstream firefox_server {
-        # ip_hash;
-#        server firefox:3000;
-        # server firefox:3000 weight=1 max_fails=3 fail_timeout=30s;
-#}
-
-# firefox
-#server {
-#        listen 80;
-#        listen [::]:80;
-        #listen 443;
-        #listen [::]:443;
-
-#        server_name firefox.bensuperpc.org www.firefox.bensuperpc.org;
-
-#        include /etc/nginx/conf.d/sub/gzip.conf;
-
-#        location / {
-#                proxy_pass http://firefox_server;
-#                proxy_buffering off;
-#                proxy_http_version 1.1;
-#                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-#                proxy_set_header Upgrade $http_upgrade;
-#                proxy_set_header Connection $http_connection;
-#                # From: https://guacamole.apache.org/doc/0.9.7/gug/proxying-guacamole.html
-#                access_log off;
-#        }
-
-        # resolver 8.8.8.8;
-#}
--- a/nginx-conf/jellyfin.conf
+++ b/nginx-conf/jellyfin.conf
@ -1,4 +1,7 @@
-#include /etc/nginx/conf.d/sub/cache-proxy.conf;
+proxy_cache_path /var/cache/nginx/jellyfin levels=1:2 keys_zone=jellyfin:100m max_size=3g inactive=30d use_temp_path=off;
+proxy_cache_path /var/cache/nginx/jellyfin-videos levels=1:2 keys_zone=jellyfin-videos:100m inactive=90d max_size=3g;
+map $request_uri $h264Level { ~(h264-level=)(.+?)& $2; }
+map $request_uri $h264Profile { ~(h264-profile=)(.+?)& $2; }

 upstream jellyfin_server {
        # ip_hash;
@ -6,43 +9,124 @@ upstream jellyfin_server {
        # server jellyfin:8096 weight=1 max_fails=3 fail_timeout=30s;
 }

-# jellyfin
+#server {
+#        listen 80;
+#        listen [::]:80;
+#        server_name jellyfin.bensuperpc.org www.jellyfin.bensuperpc.org;
+
+        # Uncomment to redirect HTTP to HTTPS
+        # return 301 https://$host$request_uri;
+#}
+
 server {
+        # listen 443 ssl http2;
+        # listen [::]:443 ssl http2;
        listen 80;
        listen [::]:80;
-        #listen 443;
-        #listen [::]:443;
-
        server_name jellyfin.bensuperpc.org www.jellyfin.bensuperpc.org;

-        include /etc/nginx/conf.d/sub/gzip.conf;
+        client_max_body_size 20M;
+        set $jellyfin jellyfin;
+        resolver 127.0.0.1 valid=30;

-        location / {
-                proxy_pass http://jellyfin_server;
-                proxy_redirect off;
-                proxy_set_header X-Forwarded-Host $http_host;
-                proxy_set_header X-Forwarded-For  $remote_addr;
-                
-                #proxy_set_header Host $host;
-                #proxy_set_header X-Real-IP $remote_addr;
-                #proxy_set_header X-Forwarded-Proto $scheme;
-                #proxy_set_header X-Forwarded-Host $host:$server_port;
-                #proxy_set_header X-Forwarded-Server $host;
-                #proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-                #proxy_set_header X-Forwarded-Ssl on;
+        #ssl_certificate /etc/letsencrypt/live/DOMAIN_NAME/fullchain.pem;
+        #ssl_certificate_key /etc/letsencrypt/live/DOMAIN_NAME/privkey.pem;
+        #ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
+        #add_header Strict-Transport-Security "max-age=31536000" always;
+        #ssl_trusted_certificate /etc/letsencrypt/live/DOMAIN_NAME/chain.pem;
+        
+        # include /etc/nginx/conf.d/sub/options-ssl-nginx.conf;

-                # Uncomment if you want to enable proxy cache
-                #proxy_cache PROXY;
-                #proxy_cache_valid 200 302 10m;
-                #proxy_cache_valid 301 1h;
-                #proxy_cache_valid any 1m;
-                #proxy_cache_lock on;
+        # Security / XSS Mitigation Headers
+        # NOTE: X-Frame-Options may cause issues with the webOS app
+        add_header X-Frame-Options "SAMEORIGIN";
+        add_header X-XSS-Protection "1; mode=block";
+        add_header X-Content-Type-Options "nosniff";
+        #add_header Content-Security-Policy "default-src https: data: blob: http://image.tmdb.org; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' https://www.gstatic.com/cv/js/sender/v1/cast_sender.js https://www.gstatic.com/eureka/clank/95/cast_sender.js https://www.gstatic.com/eureka/clank/96/cast_sender.js https://www.gstatic.com/eureka/clank/97/cast_sender.js https://www.youtube.com blob:; worker-src 'self' blob:; connect-src 'self'; object-src 'none'; frame-ancestors 'self'";

-                #proxy_ignore_headers Vary;
-                #proxy_hide_header Vary;
-
-                #add_header X-cache $upstream_cache_status;
+        location = / {
+                return 302 http://$host/web/;
+                #return 302 https://$host/web/;
        }

-        # resolver 8.8.8.8;
+        location / {
+                # Proxy main Jellyfin traffic
+                proxy_pass http://jellyfin_server;
+                proxy_set_header Host $host;
+                proxy_set_header X-Real-IP $remote_addr;
+                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+                proxy_set_header X-Forwarded-Proto $scheme;
+                proxy_set_header X-Forwarded-Protocol $scheme;
+                proxy_set_header X-Forwarded-Host $http_host;
+
+                # Disable buffering when the nginx proxy gets very resource heavy upon streaming
+                proxy_buffering off;
+        }
+
+        location = /web/ {
+                # Proxy main Jellyfin traffic
+                proxy_pass http://jellyfin_server/web/index.html;
+                proxy_set_header Host $host;
+                proxy_set_header X-Real-IP $remote_addr;
+                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+                proxy_set_header X-Forwarded-Proto $scheme;
+                proxy_set_header X-Forwarded-Protocol $scheme;
+                proxy_set_header X-Forwarded-Host $http_host;
+        }
+
+        location /socket {
+                # Proxy Jellyfin Websockets traffic
+                proxy_pass http://jellyfin_server;
+                proxy_http_version 1.1;
+                proxy_set_header Upgrade $http_upgrade;
+                proxy_set_header Connection "upgrade";
+                proxy_set_header Host $host;
+                proxy_set_header X-Real-IP $remote_addr;
+                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+                proxy_set_header X-Forwarded-Proto $scheme;
+                proxy_set_header X-Forwarded-Protocol $scheme;
+                proxy_set_header X-Forwarded-Host $http_host;
+        }
+
+        # Cache images
+        location ~ /Items/(.*)/Images {
+                proxy_pass http://127.0.0.1:8096;
+                proxy_set_header Host $host;
+                proxy_set_header X-Real-IP $remote_addr;
+                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+                proxy_set_header X-Forwarded-Proto $scheme;
+                proxy_set_header X-Forwarded-Protocol $scheme;
+                proxy_set_header X-Forwarded-Host $http_host;
+
+                proxy_cache jellyfin;
+                proxy_cache_revalidate on;
+                proxy_cache_lock on;
+                add_header X-Cache-Status $upstream_cache_status; # This is only to check if cache is working
+        }
+
+        # Cache videos
+        location ~* ^/Videos/(.*)/(?!live)
+        {
+                slice 2m;
+
+                proxy_cache jellyfin-videos;
+                proxy_cache_valid 200 206 301 302 30d;
+                proxy_ignore_headers Expires Cache-Control Set-Cookie X-Accel-Expires;
+                proxy_cache_use_stale error timeout invalid_header updating http_500 http_502 http_503 http_504;
+                proxy_connect_timeout 15s;
+                proxy_http_version 1.1;
+                proxy_set_header Connection "";
+                # Transmit slice range to the backend
+                proxy_set_header Range $slice_range;
+
+                proxy_cache_lock on;
+                proxy_cache_lock_age 60s;
+
+                proxy_pass http://$jellyfin:8096;
+                proxy_cache_key "jellyvideo$uri?MediaSourceId=$arg_MediaSourceId&VideoCodec=$arg_VideoCodec&AudioCodec=$arg_AudioCodec&AudioStreamIndex=$arg_AudioStreamIndex&VideoBitrate=$arg_VideoBitrate&AudioBitrate=$arg_AudioBitrate&SubtitleMethod=$arg_SubtitleMethod&TranscodingMaxAudioChannels=$arg_TranscodingMaxAudioChannels&RequireAvc=$arg_RequireAvc&SegmentContainer=$arg_SegmentContainer&MinSegments=$arg_MinSegments&BreakOnNonKeyFrames=$arg_BreakOnNonKeyFrames&h264-profile=$h264Profile&h264-level=$h264Level&slicerange=$slice_range";
+
+                add_header X-Cache-Status $upstream_cache_status; # This is only for debugging cache
+        }
 }
+
+# All configuration options are documented at https://jellyfin.org/docs/general/networking/nginx/
--- a/nginx-conf/phpmyadmin.conf
+++ b/nginx-conf/phpmyadmin.conf
@ -22,26 +22,6 @@ server {
                proxy_redirect off;
                proxy_set_header X-Forwarded-Host $http_host;
                proxy_set_header X-Forwarded-For  $remote_addr;
-                
-                #proxy_set_header Host $host;
-                #proxy_set_header X-Real-IP $remote_addr;
-                #proxy_set_header X-Forwarded-Proto $scheme;
-                #proxy_set_header X-Forwarded-Host $host:$server_port;
-                #proxy_set_header X-Forwarded-Server $host;
-                #proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-                #proxy_set_header X-Forwarded-Ssl on;
-
-                # Uncomment if you want to enable proxy cache
-                #proxy_cache PROXY;
-                #proxy_cache_valid 200 302 10m;
-                #proxy_cache_valid 301 1h;
-                #proxy_cache_valid any 1m;
-                #proxy_cache_lock on;
-
-                #proxy_ignore_headers Vary;
-                #proxy_hide_header Vary;
-
-                #add_header X-cache $upstream_cache_status;
        }

        # resolver 8.8.8.8;