services:
  jellyfin:
    image: jellyfin/jellyfin:latest
    network_mode: host
    restart: unless-stopped
    group_add:
      - '107' #render
      - '44' #video
    volumes:
      - ${VOLUMES_PATH}/jellyfin/config:/config
      - ${VOLUMES_PATH}/jellyfin/cache:/cache
      - type: bind
        source: ${SERIEN_PATH}
        target: /media/series
      - type: bind
        source: ${FILME_PATH}
        target: /media/movies
      - type: bind
        source: ${MUSIK_PATH}
        target: /media/music
    environment:
      - JELLYFIN_PublishedServerUrl=http://jellyfin.${DOMAIN}
    extra_hosts:
      - 'host.docker.internal:host-gateway'

#    devices:
#      # VAAPI Devices
#      - /dev/dri/renderD128:/dev/dri/renderD128
#      - /dev/dri/card0:/dev/dri/card0
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.jellyfin.rule=Host(`jellyfin.${DOMAIN}`)"
      - "traefik.http.routers.jellyfin.entrypoints=web"
      - "traefik.http.services.jellyfin.loadbalancer.server.port=8096"
      - 'traefik.http.middlewares.jellyfin-mw.headers.customResponseHeaders.X-Robots-Tag=noindex,nofollow,nosnippet,noarchive,notranslate,noimageindex'
      - 'traefik.http.middlewares.jellyfin-mw.headers.frameDeny=true'
      - 'traefik.http.middlewares.jellyfin-mw.headers.contentTypeNosniff=true'
      - 'traefik.http.middlewares.jellyfin-mw.headers.customresponseheaders.X-XSS-PROTECTION=1'
      - 'traefik.http.middlewares.jellyfin-mw.headers.browserXSSFilter=true'
      - "traefik.http.middlewares.jellyfin-mw.headers.customFrameOptionsValue='allow-from http://jellyfin.${DOMAIN}'"
      - "traefik.http.middlewares.jellyfin-mw.headers.customrequestheaders.X-Forwarded-Proto: https"
      - 'traefik.http.routers.jellyfin.middlewares=jellyfin-mw'
      - "docker.group=media"