# Jellyfin at home (ADR 0032): the home end, on the operator's own machine, which
# learn.halkyon.eu's server publishes as jellyfin.halkyon.eu (compose.jellyfin-home.yaml).
# WireGuard dials out to the instance's server, so the router opens nothing; Jellyfin
# lives in WireGuard's network namespace, so it listens on the tunnel and on this
# machine's loopback alone, and is not on the home network (no DLNA, no discovery).
# Run here, as the operator: `docker compose up -d`. Setting it up:
# ../sidecars/README.md, *Jellyfin at home*. Its folders are git-ignored: the tunnel's
# key (wireguard/), Jellyfin's configuration and cache (jellyfin/), and .env.

name: halkyon-home-jellyfin

services:
  wireguard:
    # linuxserver/wireguard 1.0.20260223-r0-ls126 (15 Oct 2026), its client mode: it
    # brings up wireguard/wg_confs/wg0.conf with the host's kernel module.
    image: lscr.io/linuxserver/wireguard@sha256:6bcf5d2f5a265c7e9835eaadd989938e681aabe8bf8bcd4556b61d463da6555c
    restart: unless-stopped
    cap_add:
      - NET_ADMIN
    sysctls:
      - net.ipv4.conf.all.src_valid_mark=1
    environment:
      PUID: "61096"
      PGID: "61096"
    volumes:
      - ./wireguard:/config
    # Jellyfin's port, which lives here: on this machine's loopback alone, for its
    # admin and for Halkyon Learn on this machine over plain HTTP (D2).
    ports:
      - 127.0.0.1:8096:8096
    networks:
      - outside

  jellyfin:
    # As the sidecar's (../compose.jellyfin.yaml): v12.2, the version Halkyon Learn's
    # Jellyfin feature is checked with.
    image: jellyfin/jellyfin@sha256:357724bf0ae27a672c7cbaa899db2d9abeb13dbd8657ccce750258a4c059d037
    restart: unless-stopped
    # As on the instance's server: a user ID no person and no other container uses.
    user: "61096:61096"
    network_mode: service:wireguard
    depends_on:
      - wireguard
    environment:
      # Never a home address in what Jellyfin hands out (D8).
      JELLYFIN_PublishedServerUrl: https://jellyfin.halkyon.eu
    volumes:
      - ./jellyfin/config:/config
      - ./jellyfin/cache:/cache
      - ${JELLYFIN_MEDIA:?set JELLYFIN_MEDIA in deploy/home-jellyfin/.env}:/media:ro

networks:
  # Out to the internet, for the tunnel and Jellyfin's metadata. A fixed subnet, so
  # Jellyfin's LAN networks can name its gateway alone, through which this machine's
  # loopback reaches it (D8).
  outside:
    ipam:
      config:
        - subnet: 172.29.96.0/24