halkyon/deploy/sidecars/jellyfin.caddy

# The Jellyfin sidecar's site (compose.jellyfin.yaml).
{$JELLYFIN_DOMAIN} {
	# Its demo account (sidecars/README.md) has no password and is everyone's: nobody
	# may change a user from outside (give it a password, change its settings or its
	# picture), only sign in. Halkyon Learn writes nothing else under /Users. The setup
	# wizard is closed too. The admin works through an SSH tunnel, which doesn't pass
	# here.
	@userChanges {
		method POST PUT DELETE
		path /Users/* /UserImage /UserImage/*
		not path /Users/AuthenticateByName /Users/AuthenticateWithQuickConnect
	}
	respond @userChanges 403
	respond /Startup/* 403

	# The sidecar's Jellyfin, or Jellyfin at home through WireGuard
	# (compose.jellyfin-home.yaml, ADR 0032).
	reverse_proxy {$JELLYFIN_UPSTREAM:jellyfin:8096}
}