# The Jellyfin sidecar (decided 2026-10-14): a Jellyfin server beside the instance, which
# people watch and listen to learn from (Halkyon Learn's Watch screen), suggested to them
# by the instance. Switched on in .env, with the domain it answers at:
#
#   COMPOSE_FILE=compose.yaml:compose.jellyfin.yaml
#   JELLYFIN_DOMAIN=jellyfin.example.org
#
# Its files are the server's, in ./jellyfin (config, cache, media), owned by a user ID
# of its own, which no person, no other container and not the CI runner uses: processes
# of one user ID can read each other's environment and files. Setting it up, and the
# demo account: sidecars/README.md.

services:
  jellyfin:
    # v12.2, the version Halkyon Learn's Jellyfin feature is checked with.
    image: jellyfin/jellyfin@sha256:357724bf0ae27a672c7cbaa899db2d9abeb13dbd8657ccce750258a4c059d037
    restart: unless-stopped
    user: "61096:61096"
    environment:
      JELLYFIN_PublishedServerUrl: https://${JELLYFIN_DOMAIN:?set JELLYFIN_DOMAIN in deploy/.env}
    volumes:
      - ./jellyfin/config:/config
      - ./jellyfin/cache:/cache
      - ./jellyfin/media:/media:ro
    # On `edge` alone, beside Caddy and the server's public API, never beside Postgres;
    # no published port. A fixed address, for the admin's SSH tunnel (sidecars/README.md).
    networks:
      edge:
        ipv4_address: 172.30.80.10
    # Videos stream as stored (the app asks for static=true): nothing is transcoded.
    mem_limit: 768m
    logging:
      driver: journald

  caddy:
    environment:
      JELLYFIN_DOMAIN: ${JELLYFIN_DOMAIN:?set JELLYFIN_DOMAIN in deploy/.env}
    volumes:
      - ./sidecars/jellyfin.caddy:/etc/caddy/sidecars/jellyfin.caddy:ro

  server:
    environment:
      # The instance suggests this Jellyfin, rather than looking for one.
      JELLYFIN_URL: https://${JELLYFIN_DOMAIN:?set JELLYFIN_DOMAIN in deploy/.env}/