admin
e5a59848f1
gates / gates (push) Successful in 5s
Jellyfin: KnownProxies 172.16.0.0/12 seeded into network.xml. Emby: LocalNetworkSubnets 10.0.0.0/8 + 192.168.0.0/16 seeded into system.xml. Fresh volume or empty list only. Measured on 9202 through the simulated tunnel: remote-off user 200 -> 403; LAN household still 200. Held on night-held-2026-10-06 (night fence); not for main tonight. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
72 lines
3.0 KiB
YAML
72 lines
3.0 KiB
YAML
# Jellyfin - Ingyenes és nyílt forráskódú média szerver
|
|
# Domain: ${SUBDOMAIN}.${DOMAIN}
|
|
# Database: None (file-based)
|
|
# RAM: ~512M (mem_limit: 2048M) | Pi-compatible: No
|
|
#
|
|
# Environment variables:
|
|
# DOMAIN - Your domain (e.g., demo-felhom.eu)
|
|
# USERDATA_PATH - Ügyfél-tartalom gyökér (<namespace>/userdata) — a média a media/ alatt
|
|
#
|
|
# Storage layout (felhom userdata convention):
|
|
# Médiatár → ${USERDATA_PATH}/media (csak olvasható; a könyvtárakat az appban választod ki)
|
|
|
|
services:
|
|
jellyfin:
|
|
image: jellyfin/jellyfin:10.11.11
|
|
container_name: jellyfin
|
|
restart: unless-stopped
|
|
# R-777: Jellyfin decides "local network" from the visitor's address (remote access per user, the IP filter,
|
|
# ForgotPassword). With KnownProxies empty it reads the TCP peer — traefik, a private address — so EVERY internet
|
|
# visitor counted as local (measured on 9202 2026-10-06: a user with remote access OFF signed in through the
|
|
# tunnel, session address 172.18.0.5). Trusting 172.16.0.0/12 (traefik, cloudflared at 172.16.253.2, docker's
|
|
# pools) makes it walk X-Forwarded-For from the right to the real visitor. There is no env var for it: the
|
|
# setting lives in network.xml, written here before the server starts — on a fresh volume, or when the list is
|
|
# still empty (a household's own list is left alone).
|
|
entrypoint:
|
|
- /bin/sh
|
|
- -c
|
|
- |
|
|
f=/config/config/network.xml
|
|
mkdir -p /config/config
|
|
if [ ! -f "$$f" ]; then
|
|
printf '%s\n' '<?xml version="1.0" encoding="utf-8"?>' '<NetworkConfiguration xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">' ' <KnownProxies>' ' <string>172.16.0.0/12</string>' ' </KnownProxies>' '</NetworkConfiguration>' > "$$f"
|
|
echo "[felhom] network.xml seeded: KnownProxies 172.16.0.0/12 (R-777)"
|
|
elif grep -q '<KnownProxies />' "$$f"; then
|
|
sed -i 's#<KnownProxies />#<KnownProxies><string>172.16.0.0/12</string></KnownProxies>#' "$$f"
|
|
echo "[felhom] network.xml: KnownProxies was empty, set to 172.16.0.0/12 (R-777)"
|
|
fi
|
|
exec /jellyfin/jellyfin
|
|
environment:
|
|
- TZ=Europe/Budapest
|
|
volumes:
|
|
- jellyfin_config:/config
|
|
- jellyfin_cache:/cache
|
|
- ${USERDATA_PATH}/media:/media:ro
|
|
networks:
|
|
- traefik-public
|
|
deploy:
|
|
resources:
|
|
limits:
|
|
memory: 2048M
|
|
healthcheck:
|
|
test: ["CMD", "curl", "-f", "http://127.0.0.1:8096/health"]
|
|
interval: 30s
|
|
timeout: 5s
|
|
retries: 3
|
|
start_period: 30s
|
|
labels:
|
|
- "traefik.enable=true"
|
|
- "traefik.http.routers.jellyfin.rule=Host(`${SUBDOMAIN}.${DOMAIN}`)"
|
|
- "traefik.http.routers.jellyfin.entrypoints=websecure"
|
|
- "traefik.http.routers.jellyfin.tls=true"
|
|
- "traefik.http.routers.jellyfin.tls.certresolver=letsencrypt"
|
|
- "traefik.http.services.jellyfin.loadbalancer.server.port=8096"
|
|
|
|
volumes:
|
|
jellyfin_cache:
|
|
jellyfin_config:
|
|
|
|
networks:
|
|
traefik-public:
|
|
external: true
|