Update ghcr.io/jellyfin/jellyfin Docker tag to v10.10.3

2024-11-22 00:03:07 +00:00
5 changed files with 60 additions and 115 deletions
--- a/flake.lock
+++ b/flake.lock
@ -223,16 +223,16 @@
        ]
      },
      "locked": {
-        "lastModified": 1726989464,
-        "narHash": "sha256-Vl+WVTJwutXkimwGprnEtXc/s/s8sMuXzqXaspIGlwM=",
+        "lastModified": 1731880681,
+        "narHash": "sha256-FmYTkIyPBUxSWgA7DPIVTsCCMvSSbs56yOtHpLNSnKg=",
        "owner": "nix-community",
        "repo": "home-manager",
-        "rev": "2f23fa308a7c067e52dfcc30a0758f47043ec176",
+        "rev": "aecd341dfead1c3ef7a3c15468ecd71e8343b7c6",
        "type": "github"
      },
      "original": {
        "owner": "nix-community",
-        "ref": "release-24.05",
+        "ref": "release-24.11",
        "repo": "home-manager",
        "type": "github"
      }
@ -456,16 +456,16 @@
    },
    "nixpkgs": {
      "locked": {
-        "lastModified": 1731797254,
-        "narHash": "sha256-df3dJApLPhd11AlueuoN0Q4fHo/hagP75LlM5K1sz9g=",
+        "lastModified": 1731755305,
+        "narHash": "sha256-v5P3dk5JdiT+4x69ZaB18B8+Rcu3TIOrcdG4uEX7WZ8=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "e8c38b73aeb218e27163376a2d617e61a2ad9b59",
+        "rev": "057f63b6dc1a2c67301286152eb5af20747a9cb4",
        "type": "github"
      },
      "original": {
        "owner": "nixos",
-        "ref": "nixos-24.05",
+        "ref": "nixos-24.11",
        "repo": "nixpkgs",
        "type": "github"
      }
--- a/nixos/modules/nixos/containers/jellyfin/default.nix
+++ b/nixos/modules/nixos/containers/jellyfin/default.nix
@ -1,7 +1,6 @@
 {
  lib,
  config,
-  pkgs,
  ...
 }:
 with lib;
@ -10,6 +9,7 @@ let
  # renovate: depName=ghcr.io/jellyfin/jellyfin datasource=docker
  version = "10.10.3";
  image = "ghcr.io/jellyfin/jellyfin:${version}";
+  port = 8096; # int
  cfg = config.mySystem.containers.${app};
 in
 {
@ -27,64 +27,37 @@ in

  # Implementation
  config = mkIf cfg.enable {
-    # Systemd service for container
-    systemd.services.${app} = {
-      description = "Jellyfin Media Server";
-      wantedBy = [ "multi-user.target" ];
-      after = [ "network.target" ];
+    # Container
+    virtualisation.oci-containers.containers.${app} = {
+      image = "${image}";
+      user = "568:568";

-      serviceConfig = {
-        ExecStartPre = "${pkgs.writeShellScript "jellyfin-start-pre" ''
-          set -o errexit
-          set -o nounset
-          set -o pipefail
+      volumes = [
+        "/nahar/containers/volumes/jellyfin:/config:rw"
+        "/moria/media:/media:rw"
+        "tmpfs:/cache:rw"
+        "tmpfs:/transcode:rw"
+        "tmpfs:/tmp:rw"
+      ];

-          podman rm -f ${app} || true
-          rm -f /run/${app}.ctr-id
-        ''}";
-        ExecStart = ''
-          ${pkgs.podman}/bin/podman run \
-            --rm \
-            --name=${app} \
-            --user=568:568 \
-            --device='nvidia.com/gpu=all' \
-            --log-driver=journald \
-            --cidfile=/run/${app}.ctr-id \
-            --cgroups=no-conmon \
-            --sdnotify=conmon \
-            --volume="/nahar/containers/volumes/jellyfin:/config:rw" \
-            --volume="/moria/media:/media:rw" \
-            --volume="tmpfs:/cache:rw" \
-            --volume="tmpfs:/transcode:rw" \
-            --volume="tmpfs:/tmp:rw" \
-            --env=TZ=America/Chicago \
-            --env=DOTNET_SYSTEM_IO_DISABLEFILELOCKING=true \
-            --env=JELLYFIN_FFmpeg__probesize=50000000 \
-            --env=JELLYFIN_FFmpeg__analyzeduration=50000000 \
-            --env=JELLYFIN_PublishedServerUrl=http://10.1.1.61:8096 \
-            -p 8096:8096 \
-            -p 8920:8920 \
-            -p 1900:1900/udp \
-            -p 7359:7359/udp \
-            ${image}
-        '';
-        ExecStop = "${pkgs.podman}/bin/podman stop --ignore --cidfile=/run/${app}.ctr-id";
-        ExecStopPost = "${pkgs.podman}/bin/podman rm --force --ignore --cidfile=/run/${app}.ctr-id";
-        Type = "simple";
-        Restart = "always";
+      environment = {
+        TZ = "America/Chicago";
+        DOTNET_SYSTEM_IO_DISABLEFILELOCKING = "true";
+        JELLYFIN_FFmpeg__probesize = "50000000";
+        JELLYFIN_FFmpeg__analyzeduration = "50000000";
      };
+
+      ports = [ "${toString port}:${toString port}" ]; # expose port
+
+      extraOptions = [
+        "--device nvidia.com/gpu=all"
+      ];
    };

    # Firewall
    networking.firewall = mkIf cfg.openFirewall {
-      allowedTCPPorts = [
-        8096    # HTTP web interface
-        8920    # HTTPS web interface
-      ];
-      allowedUDPPorts = [
-        1900    # DLNA discovery
-        7359    # Jellyfin auto-discovery
-      ];
+      allowedTCPPorts = [ port ];
+      allowedUDPPorts = [ port ];
    };

    # TODO add nginx proxy
--- a/nixos/modules/nixos/containers/plex/default.nix
+++ b/nixos/modules/nixos/containers/plex/default.nix
@ -40,13 +40,13 @@ in
      ];

      extraOptions = [
-        # "--device nvidia.com/gpu=all"
+        "--device nvidia.com/gpu=all"
      ];

      environment = {
        TZ = "America/Chicago";
-        PLEX_ADVERTISE_URL = "https://10.1.1.61:32400";
-        PLEX_NO_AUTH_NETWORKS = "10.1.1.0/24";
+        # PLEX_ADVERTISE_URL = "https://${app}.hsn.dev";
+        PLEX_NO_AUTH_NETWORKS = "10.1.1.0/24,10.1.2.0/24";
      };

      ports = [ "${toString port}:${toString port}" ]; # expose port
--- a/nixos/modules/nixos/containers/scrypted/default.nix
+++ b/nixos/modules/nixos/containers/scrypted/default.nix
@ -1,7 +1,6 @@
 {
  lib,
  config,
-  pkgs,
  ...
 }:
 with lib;
@ -10,6 +9,7 @@ let
  # renovate: depName=ghcr.io/koush/scrypted datasource=docker versioning=docker
  version = "v0.123.30-jammy-nvidia";
  image = "ghcr.io/koush/scrypted:${version}";
+  port = 11080; # int
  cfg = config.mySystem.containers.${app};
 in
 {
@ -27,57 +27,36 @@ in

  # Implementation
  config = mkIf cfg.enable {
-    # Systemd service for container
-    systemd.services.${app} = {
-      description = "Scrypted Home Security";
-      wantedBy = [ "multi-user.target" ];
-      after = [ "network.target" ];
+    # Container
+    virtualisation.oci-containers.containers.${app} = {
+      image = "${image}";

-      serviceConfig = {
-        ExecStartPre = "${pkgs.writeShellScript "scrypted-start-pre" ''
-          set -o errexit
-          set -o nounset
-          set -o pipefail
+      volumes = [
+        "/nahar/containers/volumes/scrypted:/server/volume:rw"
+        # "/nahar/scrypted:/recordings:rw"
+        "tmpfs:/.cache:rw"
+        "tmpfs:/.npm:rw"
+        "tmpfs:/tmp:rw"
+      ];

-          podman rm -f ${app} || true
-          rm -f /run/${app}.ctr-id
-        ''}";
-        ExecStart = ''
-          ${pkgs.podman}/bin/podman run \
-            --rm \
-            --name=${app} \
-            --device=/dev/bus/usb \
-            --device='nvidia.com/gpu=all' \
-            --log-driver=journald \
-            --cidfile=/run/${app}.ctr-id \
-            --cgroups=no-conmon \
-            --sdnotify=conmon \
-            --volume="/nahar/containers/volumes/scrypted:/server/volume:rw" \
-            --volume="tmpfs:/.cache:rw" \
-            --volume="tmpfs:/.npm:rw" \
-            --volume="tmpfs:/tmp:rw" \
-            --env=TZ=America/Chicago \
-            --network=host \
-            ${image}
-        '';
-        ExecStop = "${pkgs.podman}/bin/podman stop --ignore --cidfile=/run/${app}.ctr-id";
-        ExecStopPost = "${pkgs.podman}/bin/podman rm --force --ignore --cidfile=/run/${app}.ctr-id";
-        Type = "simple";
-        Restart = "always";
+      extraOptions = [
+        # all usb devices, such as coral tpu
+        "--device=/dev/bus/usb"
+        "--network=host"
+        "--device nvidia.com/gpu=all"
+      ];
+
+      environment = {
+        TZ = "America/Chicago";
      };
+
+      ports = [ "${toString port}:${toString port}" ]; # expose port
    };

    # Firewall
    networking.firewall = mkIf cfg.openFirewall {
-      allowedTCPPorts = [
-        11080 # Main Scrypted interface
-        10443 # HTTPS interface
-        8554 # RTSP server
-      ];
-      allowedUDPPorts = [
-        10443 # HTTPS interface
-        8554 # RTSP server
-      ];
+      allowedTCPPorts = [ port ];
+      allowedUDPPorts = [ port ];
    };

    # TODO add nginx proxy
--- a/nixos/modules/nixos/containers/scrypted/systemd/start-pre.sh
+++ b/nixos/modules/nixos/containers/scrypted/systemd/start-pre.sh
@ -1,7 +0,0 @@
-#!/usr/bin/env bash
-set -o errexit
-set -o nounset
-set -o pipefail
-
-podman rm -f scrypted || true
-rm -f /run/scrypted.ctr-id