From 431db062bc906b177541b031fca3dfd8a140b0d4 Mon Sep 17 00:00:00 2001
From: Haak Saxberg <haak.erling@gmail.com>
Date: Tue, 9 Aug 2022 23:56:09 -0700
Subject: [PATCH] jellyfin instead of plex

---
 nix/deployments/nixops.nix             | 33 +++++++++++++++----------
 nix/home/programs/jellyfin/default.nix | 34 ++++++++++++++++++++++++++
 nix/system/xps11/configuration.nix     | 21 ++++++++++++++--
 3 files changed, 73 insertions(+), 15 deletions(-)
 create mode 100644 nix/home/programs/jellyfin/default.nix

diff --git a/nix/deployments/nixops.nix b/nix/deployments/nixops.nix
index ba0726c..36f20ee 100644
--- a/nix/deployments/nixops.nix
+++ b/nix/deployments/nixops.nix
@@ -47,19 +47,26 @@ in
       };
     };
 
-  nas = {
-    deployment.targetHost = nasIp;
-    imports = [ ../system/svalbard/configuration.nix ];
-    networking.wireless.networks.N904.pskRaw = (
-      (import ../system/framework/keys.nix).wifi.N904.pskRaw
-    );
+  nas =
+    { pkgs, ... }:
+    {
+      deployment.targetHost = nasIp;
+      imports = [ ../system/svalbard/configuration.nix ];
+      networking.wireless.networks.N904.pskRaw = (
+        (import ../system/framework/keys.nix).wifi.N904.pskRaw
+      );
 
-    services.nfs.server.enable = true;
-    services.nfs.server.exports = ''
-      /export 192.168.1.0/24(insecure,crossmnt,fsid=0)
-      /export/storage 192.168.1.0/24(insecure)
-    '';
+      services.nfs.server.enable = true;
+      services.nfs.server.exports = ''
+        /export 192.168.1.0/24(insecure,crossmnt,fsid=0)
+        /export/storage 192.168.1.0/24(insecure)
+      '';
 
-    networking.firewall.allowedTCPPorts = [ 2049 ];
-  };
+      networking.firewall.allowedTCPPorts = [ 2049 ];
+
+      environment.systemPackages = with pkgs; [
+        flood
+        rtorrent
+      ];
+    };
 }
diff --git a/nix/home/programs/jellyfin/default.nix b/nix/home/programs/jellyfin/default.nix
new file mode 100644
index 0000000..cbd5d1a
--- /dev/null
+++ b/nix/home/programs/jellyfin/default.nix
@@ -0,0 +1,34 @@
+{
+  networking.firewall = {
+    allowedTCPPorts = [
+      # jellyfin frontend
+      8096
+      8920
+      #nginx
+      80
+    ];
+    allowedUDPPorts = [
+      # jellyfin discovery
+      1900
+      7359
+    ];
+  };
+
+  services.jellyfin.enable = true;
+
+  services.nginx = {
+    enable = true;
+    recommendedGzipSettings = true;
+    recommendedOptimisation = true;
+    recommendedProxySettings = true;
+    recommendedTlsSettings = true;
+
+    virtualHosts."mediaserver" = {
+      # http2 can more performant for streaming: https://blog.cloudflare.com/introducing-http2/
+      http2 = true;
+      locations."/" = {
+        proxyPass = "http://localhost:8096";
+      };
+    };
+  };
+}
diff --git a/nix/system/xps11/configuration.nix b/nix/system/xps11/configuration.nix
index ba6831f..90837fa 100644
--- a/nix/system/xps11/configuration.nix
+++ b/nix/system/xps11/configuration.nix
@@ -2,7 +2,7 @@
 # your system.  Help is available in the configuration.nix(5) man page
 # and in the NixOS manual (accessible by running ‘nixos-help’).
 
-{ config, pkgs, ... }:
+{ config, pkgs, lib, ... }:
 
 {
   imports =
@@ -11,7 +11,7 @@
       ./hardware-configuration.nix
       ./glibc-locale-paths.nix
       ../common/users.nix
-      ../../home/programs/plex
+      ../../home/programs/jellyfin
     ];
 
   # Use the systemd-boot EFI boot loader.
@@ -79,6 +79,23 @@
 
   services.xserver.layout = "us";
 
+  nixpkgs.config.packageOverrides = pkgs: {
+    vaapiIntel = pkgs.vaapiIntel.override { enableHybridCodec = true; };
+  };
+  hardware.opengl = {
+    enable = true;
+    extraPackages = with pkgs; [
+      intel-media-driver
+      vaapiIntel
+      vaapiVdpau
+      libvdpau-va-gl
+      intel-compute-runtime # OpenCL filter support (hardware tonemapping and subtitle burn-in)
+    ];
+  };
+
+  # 2. override default hardening measure from NixOS - this is default since 22.05
+  systemd.services.jellyfin.serviceConfig.PrivateDevices = lib.mkForce false;
+
   # Enable touchpad support.
   # services.xserver.libinput.enable = true;