feat(deploy): sidecars beside the instance, Jellyfin the first, behind an edge network
An instance may now run services beside itself, each a compose file of
its own switched on in deploy/.env (COMPOSE_FILE=compose.yaml:compose.
jellyfin.yaml), so the deploy runs them with the instance. The first is
Jellyfin, which people watch and listen to learn from: the instance then
suggests it (JELLYFIN_URL from JELLYFIN_DOMAIN), and Caddy serves its
site, refusing every change to a user from outside, so a passwordless
demo account stays everyone's; its admin signs in through an SSH tunnel.
The instance's compose gets a second network, `edge`, for Caddy (at a
fixed address, which sidecars trust as their proxy) and the server;
Postgres stays on the internal one. Caddy loses its needless way to
Postgres, and a sidecar never gains one. A sidecar publishes no port,
as the CI runner may reach 127.0.0.1, and runs as a user ID of its own.
Caddy imports the sidecars' sites from sidecars/, mounted by their
compose files (none without), and redeploy.sh recreates it when one
changes. sidecars/README.md has the steps.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
2026-10-14 00:16:53 +02:00
|
|
|
# The Jellyfin sidecar (decided 2026-10-14): a Jellyfin server beside the instance, which
|
|
|
|
|
# people watch and listen to learn from (Halkyon Learn's Watch screen), suggested to them
|
|
|
|
|
# by the instance. Switched on in .env, with the domain it answers at:
|
|
|
|
|
#
|
2026-11-02 22:06:18 +01:00
|
|
|
# COMPOSE_FILE=compose.learn.yaml:compose.jellyfin.yaml
|
feat(deploy): sidecars beside the instance, Jellyfin the first, behind an edge network
An instance may now run services beside itself, each a compose file of
its own switched on in deploy/.env (COMPOSE_FILE=compose.yaml:compose.
jellyfin.yaml), so the deploy runs them with the instance. The first is
Jellyfin, which people watch and listen to learn from: the instance then
suggests it (JELLYFIN_URL from JELLYFIN_DOMAIN), and Caddy serves its
site, refusing every change to a user from outside, so a passwordless
demo account stays everyone's; its admin signs in through an SSH tunnel.
The instance's compose gets a second network, `edge`, for Caddy (at a
fixed address, which sidecars trust as their proxy) and the server;
Postgres stays on the internal one. Caddy loses its needless way to
Postgres, and a sidecar never gains one. A sidecar publishes no port,
as the CI runner may reach 127.0.0.1, and runs as a user ID of its own.
Caddy imports the sidecars' sites from sidecars/, mounted by their
compose files (none without), and redeploy.sh recreates it when one
changes. sidecars/README.md has the steps.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
2026-10-14 00:16:53 +02:00
|
|
|
# JELLYFIN_DOMAIN=jellyfin.example.org
|
|
|
|
|
#
|
|
|
|
|
# Its files are the server's, in ./jellyfin (config, cache, media), owned by a user ID
|
2026-11-08 19:15:25 +01:00
|
|
|
# of its own; or the media in a folder elsewhere on the host that .env names
|
|
|
|
|
# (JELLYFIN_MEDIA, readable by all: halkyon.li's /data/media, ADR 0039, D15). The user ID
|
|
|
|
|
# is one no person, no other container and not the CI runner uses: processes
|
feat(deploy): sidecars beside the instance, Jellyfin the first, behind an edge network
An instance may now run services beside itself, each a compose file of
its own switched on in deploy/.env (COMPOSE_FILE=compose.yaml:compose.
jellyfin.yaml), so the deploy runs them with the instance. The first is
Jellyfin, which people watch and listen to learn from: the instance then
suggests it (JELLYFIN_URL from JELLYFIN_DOMAIN), and Caddy serves its
site, refusing every change to a user from outside, so a passwordless
demo account stays everyone's; its admin signs in through an SSH tunnel.
The instance's compose gets a second network, `edge`, for Caddy (at a
fixed address, which sidecars trust as their proxy) and the server;
Postgres stays on the internal one. Caddy loses its needless way to
Postgres, and a sidecar never gains one. A sidecar publishes no port,
as the CI runner may reach 127.0.0.1, and runs as a user ID of its own.
Caddy imports the sidecars' sites from sidecars/, mounted by their
compose files (none without), and redeploy.sh recreates it when one
changes. sidecars/README.md has the steps.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
2026-10-14 00:16:53 +02:00
|
|
|
# of one user ID can read each other's environment and files. Setting it up, and the
|
|
|
|
|
# demo account: sidecars/README.md.
|
|
|
|
|
|
|
|
|
|
services:
|
|
|
|
|
jellyfin:
|
|
|
|
|
# v12.2, the version Halkyon Learn's Jellyfin feature is checked with.
|
|
|
|
|
image: jellyfin/jellyfin@sha256:357724bf0ae27a672c7cbaa899db2d9abeb13dbd8657ccce750258a4c059d037
|
|
|
|
|
restart: unless-stopped
|
|
|
|
|
user: "61096:61096"
|
|
|
|
|
environment:
|
|
|
|
|
JELLYFIN_PublishedServerUrl: https://${JELLYFIN_DOMAIN:?set JELLYFIN_DOMAIN in deploy/.env}
|
|
|
|
|
volumes:
|
|
|
|
|
- ./jellyfin/config:/config
|
|
|
|
|
- ./jellyfin/cache:/cache
|
2026-11-08 19:15:25 +01:00
|
|
|
- ${JELLYFIN_MEDIA:-./jellyfin/media}:/media:ro
|
feat(deploy): sidecars beside the instance, Jellyfin the first, behind an edge network
An instance may now run services beside itself, each a compose file of
its own switched on in deploy/.env (COMPOSE_FILE=compose.yaml:compose.
jellyfin.yaml), so the deploy runs them with the instance. The first is
Jellyfin, which people watch and listen to learn from: the instance then
suggests it (JELLYFIN_URL from JELLYFIN_DOMAIN), and Caddy serves its
site, refusing every change to a user from outside, so a passwordless
demo account stays everyone's; its admin signs in through an SSH tunnel.
The instance's compose gets a second network, `edge`, for Caddy (at a
fixed address, which sidecars trust as their proxy) and the server;
Postgres stays on the internal one. Caddy loses its needless way to
Postgres, and a sidecar never gains one. A sidecar publishes no port,
as the CI runner may reach 127.0.0.1, and runs as a user ID of its own.
Caddy imports the sidecars' sites from sidecars/, mounted by their
compose files (none without), and redeploy.sh recreates it when one
changes. sidecars/README.md has the steps.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
2026-10-14 00:16:53 +02:00
|
|
|
# On `edge` alone, beside Caddy and the server's public API, never beside Postgres;
|
|
|
|
|
# no published port. A fixed address, for the admin's SSH tunnel (sidecars/README.md).
|
|
|
|
|
networks:
|
|
|
|
|
edge:
|
|
|
|
|
ipv4_address: 172.30.80.10
|
|
|
|
|
# Videos stream as stored (the app asks for static=true): nothing is transcoded.
|
|
|
|
|
mem_limit: 768m
|
|
|
|
|
logging:
|
|
|
|
|
driver: journald
|
|
|
|
|
|
|
|
|
|
caddy:
|
|
|
|
|
environment:
|
|
|
|
|
JELLYFIN_DOMAIN: ${JELLYFIN_DOMAIN:?set JELLYFIN_DOMAIN in deploy/.env}
|
|
|
|
|
volumes:
|
|
|
|
|
- ./sidecars/jellyfin.caddy:/etc/caddy/sidecars/jellyfin.caddy:ro
|
|
|
|
|
|
|
|
|
|
server:
|
|
|
|
|
environment:
|
|
|
|
|
# The instance suggests this Jellyfin, rather than looking for one.
|
|
|
|
|
JELLYFIN_URL: https://${JELLYFIN_DOMAIN:?set JELLYFIN_DOMAIN in deploy/.env}/
|