add api key configuration

Author: kiriwalawren

modules/jellyfin/apiKeysService.nix

@@ -0,0 +1,68 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+with lib; let
+  inherit (config) nixflix;
+  cfg = config.nixflix.jellyfin;
+in {
+  config = mkIf (nixflix.enable && cfg.enable) {
+    systemd.services.jellyfin-api-keys = {
+      description = "Jellyfin API Keys Initialization";
+      after = ["jellyfin.service"];
+      wants = ["jellyfin.service"];
+      wantedBy = ["multi-user.target"];
+
+      serviceConfig = {
+        Type = "oneshot";
+        User = cfg.user;
+        Group = cfg.group;
+        RemainAfterExit = true;
+      };
+
+      script = let
+        dbPath = "${cfg.dataDir}/data/library.db";
+      in ''
+        set -eu
+
+        # Wait for database to be created by Jellyfin
+        timeout=60
+        elapsed=0
+        while [ ! -f "${dbPath}" ] && [ $elapsed -lt $timeout ]; do
+          echo "Waiting for Jellyfin database to be created..."
+          sleep 2
+          elapsed=$((elapsed + 2))
+        done
+
+        if [ ! -f "${dbPath}" ]; then
+          echo "ERROR: Jellyfin database not found at ${dbPath} after $timeout seconds"
+          exit 1
+        fi
+
+        # Create temporary file for SQL commands
+        dbcmds=$(${pkgs.coreutils}/bin/mktemp)
+        trap "${pkgs.coreutils}/bin/rm -f $dbcmds" EXIT
+
+        echo "BEGIN TRANSACTION;" > "$dbcmds"
+
+        ${concatStringsSep "\n" (
+          mapAttrsToList (
+            appName: keyPath: ''
+              echo "REPLACE INTO ApiKeys (DateCreated, DateLastActivity, Name, AccessToken) VALUES(strftime('%Y-%m-%d %H:%M:%S', 'now'), strftime('%Y-%m-%d %H:%M:%S', 'now'), '${appName}', '$(${pkgs.coreutils}/bin/cat "${keyPath}")');" >> "$dbcmds"
+            ''
+          )
+          cfg.apikeys
+        )}
+
+        echo "COMMIT;" >> "$dbcmds"
+
+        # Execute SQL commands
+        ${pkgs.sqlite}/bin/sqlite3 "${dbPath}" < "$dbcmds"
+
+        echo "API keys initialized successfully"
+      '';
+    };
+  };
+}

modules/jellyfin/default.nix

@@ -17,6 +17,7 @@ with lib; let
 in {
   imports = [
     ./options
+    ./apiKeysService.nix
   ];
 
   config = mkIf (nixflix.enable && cfg.enable) {
@@ -25,6 +26,10 @@ in {
         assertion = cfg.vpn.enable -> config.nixflix.mullvad.enable;
         message = "Cannot enable VPN routing for Jellyfin (nixflix.jellyfin.vpn.enable = true) when Mullvad VPN is disabled. Please set nixflix.mullvad.enable = true.";
       }
+      {
+        assertion = cfg.apikeys ? default;
+        message = "Jellyfin requires at least a 'default' API key. Please configure nixflix.jellyfin.apikeys.default.";
+      }
     ];
 
     users.users.${cfg.user} = {

modules/jellyfin/options/default.nix

@@ -99,5 +99,24 @@ in {
         '';
       };
     };
+
+    apikeys = mkOption {
+      description = ''
+        API keys for Jellyfin.
+        Each attribute name is the API key name, and the value is a path to a file containing the API key.
+        The key must be a random GUID without dashes. To generate one, run:
+        ```uuidgen -r | sed 's/-//g'```
+
+        Note: At least the 'default' API key must be configured.
+      '';
+      default = {};
+      type = attrsOf path;
+      example = literalExpression ''
+        {
+          default = config.sops.secrets.jellyfin-default-key.path;
+          Jellyseerr = config.sops.secrets.jellyfin-jellyseerr-key.path;
+        }
+      '';
+    };
   };
 }

modules/jellyfin/options/users.nix

@@ -258,7 +258,7 @@ with lib; let
         example = 5;
         default = 0;
       };
-      maxParentalAgeRating = mkOption {
+      maxParentalRatingSubScore = mkOption {
         type = with types; nullOr int;
         default = null;
       };
@@ -371,7 +371,7 @@ in {
     example = {
       Admin = {
         password = "123";
-        maxParentalAgeRating = 12;
+        maxParentalRatingSubScore = 12;
         permissions = {
           isAdministrator = true;
         };