Properly expose Jellyfin

apps/jellyfin/config.json

@@ -2,10 +2,11 @@
   "$schema": "../schema.json",
   "name": "Jellyfin",
   "available": true,
+  "exposable": true,
   "port": 8091,
   "id": "jellyfin",
   "tipi_version": 1,
-  "version": "10.8.1",
+  "version": "latest",
   "categories": ["media"],
   "description": "Jellyfin is a Free Software Media System that puts you in control of managing and streaming your media. It is an alternative to the proprietary Emby and Plex, to provide media from a dedicated server to end-user devices via multiple apps. Jellyfin is descended from Emby's 3.5.2 release and ported to the .NET Core framework to enable full cross-platform support. There are no strings attached, no premium licenses or features, and no hidden agendas: just a team who want to build something better and work together to achieve it. We welcome anyone who is interested in joining us in our quest!",
   "short_desc": "A media server for your home collection",

apps/jellyfin/docker-compose.yml

@@ -1,18 +1,42 @@
 version: "3.7"
-
 services:
   jellyfin:
-    image: lscr.io/linuxserver/jellyfin:10.8.1
+    image: jellyfin/jellyfin:latest
     container_name: jellyfin
     volumes:
       - ${APP_DATA_DIR}/data/config:/config
-      - ${ROOT_FOLDER_HOST}/media/data:/media/data
+      - ${APP_DATA_DIR}/data/cache:/cache
+      - ${ROOT_FOLDER_HOST}/media/data:/movies:ro
     environment:
       - PUID=1000
       - PGID=1000
       - TZ=${TZ}
+      - JELLYFIN_PublishedServerUrl=https://${APP_DOMAIN}
     restart: "unless-stopped"
     ports:
       - ${APP_PORT}:8096
     networks:
       - tipi_main_network
+    labels:
+      traefik.enable: ${APP_EXPOSED}
+      traefik.http.middlewares.jellyfin-mw.headers.SSLForceHost: true
+      traefik.http.middlewares.jellyfin-mw.headers.SSLHost: ${APP_DOMAIN}
+      traefik.http.middlewares.jellyfin-mw.headers.SSLRedirect: true
+      traefik.http.middlewares.jellyfin-mw.headers.STSIncludeSubdomains: true
+      traefik.http.middlewares.jellyfin-mw.headers.STSPreload: true
+      traefik.http.middlewares.jellyfin-mw.headers.STSSeconds: 315360000
+      traefik.http.middlewares.jellyfin-mw.headers.browserXSSFilter: true
+      traefik.http.middlewares.jellyfin-mw.headers.contentTypeNosniff: true
+      traefik.http.middlewares.jellyfin-mw.headers.customFrameOptionsValue: 'allow-from https://${DOMAIN}'
+      traefik.http.middlewares.jellyfin-mw.headers.customResponseHeaders.X-Robots-Tag: noindex,nofollow,nosnippet,noarchive,notranslate,noimageindex
+      traefik.http.middlewares.jellyfin-mw.headers.forceSTSHeader: true
+      traefik.http.middlewares.jellyfin-mw.headers.frameDeny: true
+      traefik.http.routers.jellyfin.entryPoints: websecure
+      traefik.http.routers.jellyfin.middlewares: jellyfin-mw
+      traefik.http.routers.jellyfin.rule: Host(`${APP_DOMAIN}`)
+      traefik.http.routers.jellyfin.service: jellyfin-svc
+      traefik.http.routers.jellyfin.tls: true
+      traefik.http.routers.jellyfin.tls.certresolver: myresolver
+      traefik.http.routers.jellyfin.tls.domains: ${APP_DOMAIN}
+      traefik.http.services.jellyfin-svc.loadBalancer.passHostHeader: true
+      traefik.http.services.jellyfin-svc.loadBalancer.server.port: 8096