darmanandClaude Sonnet 5
6c8046bac8
Enables hardware.graphics + intel-media-driver for the Apollo Lake's Gen9 iGPU (VAAPI only — QSV needs an insecure/EOL runtime on this chip) and adds jellyfin's service user to video/render for the DRI card node. 4K HDR still can't be tone-mapped on this hardware; those files need to direct-play or be kept as 1080p SDR. Also relocates podman's container storage and immich's postgres cluster to /mnt/data/AppData, after a deploy holding two ~9G closures at once filled the 29G eMMC and postgres died mid-write. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
26 lines
1.2 KiB
Nix
26 lines
1.2 KiB
Nix
{ lib, ... }:
|
|
|
|
{
|
|
services.jellyfin = {
|
|
enable = true;
|
|
dataDir = "/mnt/data/AppData/jellyfin";
|
|
cacheDir = "/mnt/data/AppData/jellyfin/cache";
|
|
};
|
|
# "users" so the shared library stays readable (see the UMask note below);
|
|
# "video"/"render" for the DRI nodes used by hardware transcoding. renderD128
|
|
# happens to be 0666 so VAAPI alone would work without this, but card1 is
|
|
# 0660 root:video — and neither mode is guaranteed, so don't rely on it. The
|
|
# groups are harmless on a host with no GPU: they exist regardless, and this
|
|
# module stays host-agnostic (the DRIVER is enabled per-host, e.g. jupiter's
|
|
# hardware.graphics + intel-media-driver).
|
|
users.users.jellyfin.extraGroups = [ "users" "video" "render" ];
|
|
|
|
# The upstream module hardcodes UMask=0077 — root cause of jellyfin writing
|
|
# trickplay thumbnails into stray new show folders it invented itself,
|
|
# owned jellyfin:jellyfin 700, invisible to every other service sharing
|
|
# the library (cinephage, mediamanager, ...). New files/dirs it creates
|
|
# from here on inherit group "users" (library roots are setgid, see the
|
|
# one-time chmod g+s done by hand) and stay group-writable.
|
|
systemd.services.jellyfin.serviceConfig.UMask = lib.mkForce "0002";
|
|
}
|