{
  networking.firewall = {
    allowedTCPPorts = [
      # jellyfin frontend
      8096
      8920
      #nginx
      80
    ];
    allowedUDPPorts = [
      # jellyfin discovery
      1900
      7359
    ];
  };

  services.jellyfin.enable = true;

  services.nginx = {
    enable = true;
    recommendedGzipSettings = true;
    recommendedOptimisation = true;
    recommendedProxySettings = true;
    recommendedTlsSettings = true;

    virtualHosts."mediaserver" = {
      # http2 can more performant for streaming: https://blog.cloudflare.com/introducing-http2/
      http2 = true;
      locations."/" = {
        proxyPass = "http://localhost:8096";
      };
    };
  };
}