mirror of
https://github.com/ryan4yin/nix-config.git
synced 2026-11-13 12:13:46 +01:00
ryan4yin | 二花
a111676ede
* feat(youko): add Jellyfin media server Jellyfin reads the existing Transmission download tree on the public HDD (via the shared `fileshare` group) and transcodes with the AMD Barceló iGPU through VA-API. Encoding settings are declared in Nix (`forceEncodingConfig`), so the web UI cannot silently drift. Replace the per-service public ACME certificates with a single `*.writefor.fun` wildcard (plus the apex) shared by every public vhost, so adding a service needs no new ACME entry; a wildcard also keeps individual hostnames out of public CT logs. Pin the jellyfin uid/gid to avoid the dynamic-id drift fixed for the other services in #320. * fix(youko): enable graphics for Jellyfin VA-API VA-API needs Mesa's radeonsi VA driver under /run/opengl-driver, but youko is headless so hardware.graphics was off. Without it Jellyfin's ffmpeg fails with 'va_openDriver() returns -1'. Enable it so the iGPU can be used for hardware transcoding. * fix(youko): use VA-API hardware encoding for Jellyfin Enabling hardware decoding alone left encoding on the CPU (libx264), which pins ~3 cores per 720p stream. Set transcoding.enableHardwareEncoding so the iGPU (Vega VCN) does the H.264 encode too. * feat(youko): harden Jellyfin proxy trust, groups, and HEVC encode Add jellyfin to the render/video groups for robust VA-API access (was relying on the world-writable render node), enable HEVC hardware encoding (Vega's VCN supports it; AV1 does not), and patch network.xml on start to trust Caddy as KnownProxies and advertise the public URL. * fix(youko): run Jellyfin network.xml patch every start; allow LAN discovery The module's preStart exits early once encoding.xml matches, so the mkAfter network.xml patch only ran when encoding settings changed. Run it with mkBefore instead. Also allow Jellyfin app auto-discovery (UDP 7359 / TCP 8096) from the home network only.
57 lines
1.6 KiB
Nix
57 lines
1.6 KiB
Nix
{
|
|
...
|
|
}:
|
|
{
|
|
# Service users/groups are created by their modules with a dynamically
|
|
# allocated uid/gid. That allocation is not stable when the set of users
|
|
# changes -- adding the `immich` user shifted gitea from 993:985 to 996:993
|
|
# and rustfs from 987:977 to 988:983 -- while files on the persistent volumes
|
|
# keep the old numeric owner. The service then loses access to its own data
|
|
# (gitea and rustfs failed to start this way after a restart).
|
|
#
|
|
# Pin every dynamically allocated id on this host to its current value so it
|
|
# can never shift again. The ids are host-specific (other hosts already have
|
|
# their own values and data), so this lives in the host config rather than a
|
|
# shared module.
|
|
users.users = {
|
|
jellyfin.uid = 984;
|
|
sftpgo.uid = 987;
|
|
rustfs.uid = 988;
|
|
redis-shared.uid = 989;
|
|
postgres-exporter.uid = 990;
|
|
node-exporter.uid = 992;
|
|
microvm.uid = 993;
|
|
immich.uid = 994;
|
|
homepage.uid = 995;
|
|
gitea.uid = 996;
|
|
btrbk.uid = 997;
|
|
avahi.uid = 998;
|
|
acme.uid = 999;
|
|
};
|
|
|
|
users.groups = {
|
|
jellyfin.gid = 974;
|
|
wireshark.gid = 975;
|
|
victoriametrics-data.gid = 976;
|
|
uinput.gid = 977;
|
|
sftpgo.gid = 981;
|
|
ryan.gid = 982;
|
|
rustfs.gid = 983;
|
|
redis-shared.gid = 984;
|
|
postgres-exporter.gid = 985;
|
|
podman.gid = 986;
|
|
plugdev.gid = 987;
|
|
node-exporter.gid = 989;
|
|
immich.gid = 990;
|
|
homepage.gid = 991;
|
|
grafana.gid = 992;
|
|
gitea.gid = 993;
|
|
fileshare.gid = 994;
|
|
docker.gid = 995;
|
|
btrbk.gid = 996;
|
|
avahi.gid = 997;
|
|
adbusers.gid = 998;
|
|
acme.gid = 999;
|
|
};
|
|
}
|