Update jellyfin

Signed-off-by: Bensuperpc <bensuperpc@gmail.com>

Makefile

@@ -20,7 +20,6 @@
 
 DOCKER := docker
 
-DISABLED_PROFILE := firefox
 PROFILE := wp_db wordpress webserver certbot phpmyadmin flask_website flask_db pgadmin qbittorrent jellyfin
 PROFILE_CMD := $(addprefix --profile ,$(PROFILE))
 
@@ -29,7 +28,7 @@ COMPOSE_FILE := docker-compose.yml
 AUTHOR := bensuperpc
 
 IMAGE_NAME := wordpress:6.1.1-php8.1-fpm mariadb:10.10.2 nginx:1.23 certbot/certbot:v1.32.0 phpmyadmin:5.2.0 dpage/pgadmin4:6.16 lscr.io/linuxserver/qbittorrent:latest \
-		lscr.io/linuxserver/jellyfin:latest firefox:latest lscr.io/linuxserver/firefox:latest
+		lscr.io/linuxserver/jellyfin:latest
 
 #IMAGE_AUTHOR := $(addprefix itzg/, $(IMAGE_NAME))
 

docker-compose.yml

@@ -122,25 +122,6 @@ services:
     restart: unless-stopped
     networks:
       - app-network
-#  firefox:
-#    image: lscr.io/linuxserver/firefox:latest
-#    container_name: firefox
-#    profiles:
-#      - firefox
-#    security_opt:
-#      - seccomp:unconfined #optional
-#    environment:
-#      - PUID=1000
-#      - PGID=1000
-#      - TZ=Europe/London
-#    volumes:
-#      - firefox-config:/config
-    #ports:
-    #  - 3000:3000
-#    shm_size: "1gb"
-#    restart: unless-stopped
-#    networks:
-#      - app-network
   certbot:
     depends_on:
       - webserver
@@ -200,8 +181,6 @@ volumes:
     name: jellyfin-tvseries
   jellyfin-movies:
     name: jellyfin-movies
-  firefox-config:
-    name: firefox-config
   postgres-data:
     name: postgres-data
 

nginx-conf/firefox.conf

@@ -1,30 +0,0 @@
-#upstream firefox_server {
-        # ip_hash;
-#        server firefox:3000;
-        # server firefox:3000 weight=1 max_fails=3 fail_timeout=30s;
-#}
-
-# firefox
-#server {
-#        listen 80;
-#        listen [::]:80;
-        #listen 443;
-        #listen [::]:443;
-
-#        server_name firefox.bensuperpc.org www.firefox.bensuperpc.org;
-
-#        include /etc/nginx/conf.d/sub/gzip.conf;
-
-#        location / {
-#                proxy_pass http://firefox_server;
-#                proxy_buffering off;
-#                proxy_http_version 1.1;
-#                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-#                proxy_set_header Upgrade $http_upgrade;
-#                proxy_set_header Connection $http_connection;
-#                # From: https://guacamole.apache.org/doc/0.9.7/gug/proxying-guacamole.html
-#                access_log off;
-#        }
-
-        # resolver 8.8.8.8;
-#}

nginx-conf/jellyfin.conf

@@ -1,4 +1,7 @@
-#include /etc/nginx/conf.d/sub/cache-proxy.conf;
+proxy_cache_path /var/cache/nginx/jellyfin levels=1:2 keys_zone=jellyfin:100m max_size=3g inactive=30d use_temp_path=off;
+proxy_cache_path /var/cache/nginx/jellyfin-videos levels=1:2 keys_zone=jellyfin-videos:100m inactive=90d max_size=3g;
+map $request_uri $h264Level { ~(h264-level=)(.+?)& $2; }
+map $request_uri $h264Profile { ~(h264-profile=)(.+?)& $2; }
 
 upstream jellyfin_server {
         # ip_hash;
@@ -6,43 +9,124 @@ upstream jellyfin_server {
         # server jellyfin:8096 weight=1 max_fails=3 fail_timeout=30s;
 }
 
-# jellyfin
+#server {
+#        listen 80;
+#        listen [::]:80;
+#        server_name jellyfin.bensuperpc.org www.jellyfin.bensuperpc.org;
+
+        # Uncomment to redirect HTTP to HTTPS
+        # return 301 https://$host$request_uri;
+#}
+
 server {
+        # listen 443 ssl http2;
+        # listen [::]:443 ssl http2;
         listen 80;
         listen [::]:80;
-        #listen 443;
-        #listen [::]:443;
-
         server_name jellyfin.bensuperpc.org www.jellyfin.bensuperpc.org;
 
-        include /etc/nginx/conf.d/sub/gzip.conf;
+        client_max_body_size 20M;
+        set $jellyfin jellyfin;
+        resolver 127.0.0.1 valid=30;
 
-        location / {
+        #ssl_certificate /etc/letsencrypt/live/DOMAIN_NAME/fullchain.pem;
-                proxy_pass http://jellyfin_server;
+        #ssl_certificate_key /etc/letsencrypt/live/DOMAIN_NAME/privkey.pem;
-                proxy_redirect off;
+        #ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
-                proxy_set_header X-Forwarded-Host $http_host;
+        #add_header Strict-Transport-Security "max-age=31536000" always;
-                proxy_set_header X-Forwarded-For  $remote_addr;
+        #ssl_trusted_certificate /etc/letsencrypt/live/DOMAIN_NAME/chain.pem;
-                
+        
-                #proxy_set_header Host $host;
+        # include /etc/nginx/conf.d/sub/options-ssl-nginx.conf;
-                #proxy_set_header X-Real-IP $remote_addr;
-                #proxy_set_header X-Forwarded-Proto $scheme;
-                #proxy_set_header X-Forwarded-Host $host:$server_port;
-                #proxy_set_header X-Forwarded-Server $host;
-                #proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-                #proxy_set_header X-Forwarded-Ssl on;
 
-                # Uncomment if you want to enable proxy cache
+        # Security / XSS Mitigation Headers
-                #proxy_cache PROXY;
+        # NOTE: X-Frame-Options may cause issues with the webOS app
-                #proxy_cache_valid 200 302 10m;
+        add_header X-Frame-Options "SAMEORIGIN";
-                #proxy_cache_valid 301 1h;
+        add_header X-XSS-Protection "1; mode=block";
-                #proxy_cache_valid any 1m;
+        add_header X-Content-Type-Options "nosniff";
-                #proxy_cache_lock on;
+        #add_header Content-Security-Policy "default-src https: data: blob: http://image.tmdb.org; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' https://www.gstatic.com/cv/js/sender/v1/cast_sender.js https://www.gstatic.com/eureka/clank/95/cast_sender.js https://www.gstatic.com/eureka/clank/96/cast_sender.js https://www.gstatic.com/eureka/clank/97/cast_sender.js https://www.youtube.com blob:; worker-src 'self' blob:; connect-src 'self'; object-src 'none'; frame-ancestors 'self'";
 
-                #proxy_ignore_headers Vary;
+        location = / {
-                #proxy_hide_header Vary;
+                return 302 http://$host/web/;
-
+                #return 302 https://$host/web/;
-                #add_header X-cache $upstream_cache_status;
         }
 
-        # resolver 8.8.8.8;
+        location / {
+                # Proxy main Jellyfin traffic
+                proxy_pass http://jellyfin_server;
+                proxy_set_header Host $host;
+                proxy_set_header X-Real-IP $remote_addr;
+                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+                proxy_set_header X-Forwarded-Proto $scheme;
+                proxy_set_header X-Forwarded-Protocol $scheme;
+                proxy_set_header X-Forwarded-Host $http_host;
+
+                # Disable buffering when the nginx proxy gets very resource heavy upon streaming
+                proxy_buffering off;
+        }
+
+        location = /web/ {
+                # Proxy main Jellyfin traffic
+                proxy_pass http://jellyfin_server/web/index.html;
+                proxy_set_header Host $host;
+                proxy_set_header X-Real-IP $remote_addr;
+                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+                proxy_set_header X-Forwarded-Proto $scheme;
+                proxy_set_header X-Forwarded-Protocol $scheme;
+                proxy_set_header X-Forwarded-Host $http_host;
+        }
+
+        location /socket {
+                # Proxy Jellyfin Websockets traffic
+                proxy_pass http://jellyfin_server;
+                proxy_http_version 1.1;
+                proxy_set_header Upgrade $http_upgrade;
+                proxy_set_header Connection "upgrade";
+                proxy_set_header Host $host;
+                proxy_set_header X-Real-IP $remote_addr;
+                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+                proxy_set_header X-Forwarded-Proto $scheme;
+                proxy_set_header X-Forwarded-Protocol $scheme;
+                proxy_set_header X-Forwarded-Host $http_host;
+        }
+
+        # Cache images
+        location ~ /Items/(.*)/Images {
+                proxy_pass http://127.0.0.1:8096;
+                proxy_set_header Host $host;
+                proxy_set_header X-Real-IP $remote_addr;
+                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+                proxy_set_header X-Forwarded-Proto $scheme;
+                proxy_set_header X-Forwarded-Protocol $scheme;
+                proxy_set_header X-Forwarded-Host $http_host;
+
+                proxy_cache jellyfin;
+                proxy_cache_revalidate on;
+                proxy_cache_lock on;
+                add_header X-Cache-Status $upstream_cache_status; # This is only to check if cache is working
+        }
+
+        # Cache videos
+        location ~* ^/Videos/(.*)/(?!live)
+        {
+                slice 2m;
+
+                proxy_cache jellyfin-videos;
+                proxy_cache_valid 200 206 301 302 30d;
+                proxy_ignore_headers Expires Cache-Control Set-Cookie X-Accel-Expires;
+                proxy_cache_use_stale error timeout invalid_header updating http_500 http_502 http_503 http_504;
+                proxy_connect_timeout 15s;
+                proxy_http_version 1.1;
+                proxy_set_header Connection "";
+                # Transmit slice range to the backend
+                proxy_set_header Range $slice_range;
+
+                proxy_cache_lock on;
+                proxy_cache_lock_age 60s;
+
+                proxy_pass http://$jellyfin:8096;
+                proxy_cache_key "jellyvideo$uri?MediaSourceId=$arg_MediaSourceId&VideoCodec=$arg_VideoCodec&AudioCodec=$arg_AudioCodec&AudioStreamIndex=$arg_AudioStreamIndex&VideoBitrate=$arg_VideoBitrate&AudioBitrate=$arg_AudioBitrate&SubtitleMethod=$arg_SubtitleMethod&TranscodingMaxAudioChannels=$arg_TranscodingMaxAudioChannels&RequireAvc=$arg_RequireAvc&SegmentContainer=$arg_SegmentContainer&MinSegments=$arg_MinSegments&BreakOnNonKeyFrames=$arg_BreakOnNonKeyFrames&h264-profile=$h264Profile&h264-level=$h264Level&slicerange=$slice_range";
+
+                add_header X-Cache-Status $upstream_cache_status; # This is only for debugging cache
+        }
 }
+
+# All configuration options are documented at https://jellyfin.org/docs/general/networking/nginx/

nginx-conf/phpmyadmin.conf

@@ -22,26 +22,6 @@ server {
                 proxy_redirect off;
                 proxy_set_header X-Forwarded-Host $http_host;
                 proxy_set_header X-Forwarded-For  $remote_addr;
-                
-                #proxy_set_header Host $host;
-                #proxy_set_header X-Real-IP $remote_addr;
-                #proxy_set_header X-Forwarded-Proto $scheme;
-                #proxy_set_header X-Forwarded-Host $host:$server_port;
-                #proxy_set_header X-Forwarded-Server $host;
-                #proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-                #proxy_set_header X-Forwarded-Ssl on;
-
-                # Uncomment if you want to enable proxy cache
-                #proxy_cache PROXY;
-                #proxy_cache_valid 200 302 10m;
-                #proxy_cache_valid 301 1h;
-                #proxy_cache_valid any 1m;
-                #proxy_cache_lock on;
-
-                #proxy_ignore_headers Vary;
-                #proxy_hide_header Vary;
-
-                #add_header X-cache $upstream_cache_status;
         }
 
         # resolver 8.8.8.8;