{ lib, ... }:

{
  services.jellyfin = {
    enable = true;
    dataDir = "/mnt/data/AppData/jellyfin";
    cacheDir = "/mnt/data/AppData/jellyfin/cache";
  };
  # "users" keeps the shared library readable (see the UMask note below);
  # "video"/"render" cover the DRI nodes for hardware transcoding — card1 is
  # 0660 root:video (not guaranteed 0666 like renderD128), so don't rely on
  # device perms alone. Harmless on a GPU-less host: the driver itself is
  # enabled per-host (e.g. jupiter's hardware.graphics + intel-media-driver).
  users.users.jellyfin.extraGroups = [ "users" "video" "render" ];

  # The upstream module hardcodes UMask=0077, which made jellyfin write
  # trickplay thumbnails into new folders owned jellyfin:jellyfin 700 —
  # invisible to every other service sharing the library (cinephage,
  # mediamanager). Forcing 0002 makes new files inherit group "users"
  # (library roots are setgid via a one-time chmod g+s) and stay group-writable.
  systemd.services.jellyfin.serviceConfig.UMask = lib.mkForce "0002";
}