create wizard automation, system config, and users services

Author: kiriwalawren

modules/jellyfin/apiKeysService.nix

@@ -11,8 +11,8 @@ in {
   config = mkIf (nixflix.enable && cfg.enable) {
     systemd.services.jellyfin-api-keys = {
       description = "Jellyfin API Keys Initialization";
-      after = ["jellyfin.service"];
-      wants = ["jellyfin.service"];
+      after = ["jellyfin-initialization.service"];
+      wants = ["jellyfin-initialization.service"];
       wantedBy = ["multi-user.target"];
 
       serviceConfig = {

modules/jellyfin/default.nix

@@ -17,7 +17,11 @@ with lib; let
 in {
   imports = [
     ./options
+    ./initializationService.nix
     ./apiKeysService.nix
+    ./setupWizardService.nix
+    ./systemConfigService.nix
+    ./usersConfigService.nix
   ];
 
   config = mkIf (nixflix.enable && cfg.enable) {
@@ -27,8 +31,8 @@ in {
         message = "Cannot enable VPN routing for Jellyfin (nixflix.jellyfin.vpn.enable = true) when Mullvad VPN is disabled. Please set nixflix.mullvad.enable = true.";
       }
       {
-        assertion = cfg.apikeys ? default;
-        message = "Jellyfin requires at least a 'default' API key. Please configure nixflix.jellyfin.apikeys.default.";
+        assertion = any (user: user.policy.isAdministrator) (attrValues cfg.users);
+        message = "At least one Jellyfin user must have policy.isAdministrator = true.";
       }
     ];
 

modules/jellyfin/initializationService.nix

@@ -0,0 +1,59 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+with lib; let
+  inherit (config) nixflix;
+  cfg = config.nixflix.jellyfin;
+in {
+  config = mkIf (nixflix.enable && cfg.enable) {
+    systemd.services.jellyfin-initialization = {
+      description = "Wait for Jellyfin Initialization";
+      after = ["jellyfin.service"];
+      wants = ["jellyfin.service"];
+      wantedBy = ["multi-user.target"];
+
+      serviceConfig = {
+        Type = "oneshot";
+        RemainAfterExit = true;
+      };
+
+      script = ''
+        set -eu
+
+        LOG_FILE="${cfg.logDir}/log_$(${pkgs.coreutils}/bin/date +%Y%m%d).log"
+        BASE_URL="http://127.0.0.1:${toString cfg.network.internalHttpPort}${cfg.network.baseUrl}"
+
+        echo "Waiting for Jellyfin to complete startup..."
+        for i in {1..60}; do
+          if [ -f "$LOG_FILE" ]; then
+            if ${pkgs.gnugrep}/bin/grep -q "Startup complete" "$LOG_FILE"; then
+              echo "Jellyfin startup complete"
+              break
+            fi
+          fi
+          if [[ $i -eq 60 ]]; then
+            echo "Jellyfin did not complete startup after 120 seconds" >&2
+            exit 1
+          fi
+          sleep 2
+        done
+
+        echo "Waiting for Jellyfin API to be available..."
+        for i in {1..90}; do
+          if ${pkgs.curl}/bin/curl -s -f "$BASE_URL/System/Ping" >/dev/null 2>&1; then
+            echo "Jellyfin API is available"
+            exit 0
+          fi
+          if [[ $i -eq 90 ]]; then
+            echo "Jellyfin API not available after 90 seconds" >&2
+            exit 1
+          fi
+          sleep 1
+        done
+      '';
+    };
+  };
+}

modules/jellyfin/options/system.nix

@@ -155,7 +155,7 @@ in {
       '';
     };
 
-    inactiveSessionThreshhold = mkOption {
+    inactiveSessionThreshold = mkOption {
       type = types.int;
       default = 0;
     };
@@ -170,6 +170,14 @@ in {
       default = 30;
     };
 
+    cacheSize = mkOption {
+      type = types.int;
+      default = 0;
+      description = ''
+        Cache size in MB. 0 means no limit.
+      '';
+    };
+
     imageSavingConvention = mkOption {
       type = types.enum ["Legacy"];
       default = "Legacy";
@@ -291,7 +299,18 @@ in {
     saveMetadataHidden = mkEnableOption "";
 
     contentTypes = mkOption {
-      type = with types; listOf str;
+      type = with types; listOf (submodule {
+        options = {
+          name = mkOption {
+            type = str;
+            description = "Content type name";
+          };
+          value = mkOption {
+            type = str;
+            description = "Content type value";
+          };
+        };
+      });
       default = [];
     };
 
@@ -302,7 +321,9 @@ in {
 
     enableFolderView = mkEnableOption "";
 
-    enableGroupingIntoCollections = mkEnableOption "";
+    enableGroupingMoviesIntoCollections = mkEnableOption "";
+
+    enableGroupingShowsIntoCollections = mkEnableOption "";
 
     displaySpecialsWithinSeasons = mkOption {
       type = types.bool;
@@ -341,7 +362,18 @@ in {
     };
 
     pathSubstitutions = mkOption {
-      type = with types; listOf str;
+      type = with types; listOf (submodule {
+        options = {
+          from = mkOption {
+            type = str;
+            description = "Path to substitute from";
+          };
+          to = mkOption {
+            type = str;
+            description = "Path to substitute to";
+          };
+        };
+      });
       default = [];
     };
 
@@ -549,5 +581,13 @@ in {
         '';
       };
     };
+
+    enableLegacyAuthorization = mkOption {
+      type = types.bool;
+      default = false;
+      description = ''
+        Enable legacy authorization mode for backwards compatibility.
+      '';
+    };
   };
 }

modules/jellyfin/options/users.nix

@@ -2,11 +2,9 @@
 with lib; let
   preferenceOpts = _: {
     options = {
-      # NOTE: renamed from internal EnabledFolders, since
-      # it makes more sense to call it library not folder
       enabledLibraries = mkOption {
         type = types.listOf types.str;
-        default = []; # empty means all are enabled
+        default = [];
         description = ''
           A list of libraries this user as access to.
           If it is empty, it means that the user has access to all libraries.
@@ -18,6 +16,26 @@ with lib; let
           "Family Photos"
         ];
       };
+
+      groupedFolders = mkOption {
+        type = types.listOf types.str;
+        default = [];
+      };
+
+      orderedViews = mkOption {
+        type = types.listOf types.str;
+        default = [];
+      };
+
+      latestItemsExcludes = mkOption {
+        type = types.listOf types.str;
+        default = [];
+      };
+
+      myMediaExcludes = mkOption {
+        type = types.listOf types.str;
+        default = [];
+      };
     };
   };
   # See: https://github.com/jellyfin/jellyfin/blob/master/src/Jellyfin.Database/Jellyfin.Database.Implementations/Enums/PermissionKind.cs
@@ -144,6 +162,95 @@ with lib; let
         default = false;
         description = "Whether the server should force transcoding on remote connections for the user";
       };
+
+      maxParentalRating = mkOption {
+        type = types.nullOr types.int;
+        default = null;
+      };
+
+      blockedTags = mkOption {
+        type = types.listOf types.str;
+        default = [];
+      };
+
+      allowedTags = mkOption {
+        type = types.listOf types.str;
+        default = [];
+      };
+
+      blockUnratedItems = mkOption {
+        type = types.listOf types.str;
+        default = [];
+      };
+
+      enabledDevices = mkOption {
+        type = types.listOf types.str;
+        default = [];
+      };
+
+      enabledChannels = mkOption {
+        type = types.listOf types.str;
+        default = [];
+      };
+
+      blockedMediaFolders = mkOption {
+        type = types.listOf types.str;
+        default = [];
+      };
+
+      blockedChannels = mkOption {
+        type = types.listOf types.str;
+        default = [];
+      };
+
+      enableContentDeletionFromFolders = mkOption {
+        type = types.listOf types.str;
+        default = [];
+      };
+
+      accessSchedules = mkOption {
+        type = types.listOf (types.submodule {
+          options = {
+            dayOfWeek = mkOption {
+              type = types.enum [
+                "Sunday"
+                "Monday"
+                "Tuesday"
+                "Wednesday"
+                "Thursday"
+                "Friday"
+                "Saturday"
+              ];
+            };
+            startHour = mkOption {
+              type = types.ints.between 0 23;
+            };
+            endHour = mkOption {
+              type = types.ints.between 0 23;
+            };
+          };
+        });
+        default = [];
+      };
+
+      syncPlayAccess = mkOption {
+        type = types.bool;
+        description = "Whether or not this user has access to SyncPlay";
+        example = true;
+        default = false;
+      };
+
+      authenticationProviderId = mkOption {
+        type = types.str;
+        default = "Jellyfin.Server.Implementations.Users.DefaultAuthenticationProvider";
+        description = "Authentication provider ID";
+      };
+
+      passwordResetProviderId = mkOption {
+        type = types.str;
+        default = "Jellyfin.Server.Implementations.Users.DefaultPasswordResetProvider";
+        description = "Password reset provider ID";
+      };
     };
   };
   userOpts = _: {
@@ -160,8 +267,8 @@ with lib; let
           ];
         };
       };
-      permissions = mkOption {
-        description = "Permissions for this user";
+      policy = mkOption {
+        description = "Policy for this user";
         default = {};
         type = with types; submodule permissionOpts;
         example = {
@@ -181,6 +288,10 @@ with lib; let
           and no nix configuration changes will have any effect.
           If false however, all options are overwritten as specified in the nix configuration,
           which means any change through the Jellyfin GUI will have no effect after a rebuild.
+
+          Note: Passwords are only set during user creation and are never updated
+          declaratively, regardless of the mutable setting. To change a user's password,
+          use the Jellyfin web interface.
         '';
         default = true;
       };
@@ -262,24 +373,10 @@ with lib; let
         type = with types; nullOr int;
         default = null;
       };
-      hashedPassword = mkOption {
-        type = types.nullOr types.str;
-        default = null;
-        description = ''
-          A pbkdf2-sha512 hash of the user password.
-          Generate using: nix run github:kiriwalawren/nixflix#genhash -- -k <password> -i 210000 -l 128 -u
-        '';
-        example = "$PBKDF2-SHA512$iterations=210000$D12C02D1DD15949D867BCA9971BE9987$67E75CDCD14E7F6FDDF96BAACBE9E84E5197FB9FE454FB039F5CD773D7DF558B57DC81DB42B6F7CF0E6B8207A771E5C0EE0DBFD91CE5BAF804FE53F70E61CD2E";
-      };
-      hashedPasswordFile = mkOption {
+      passwordFile = mkOption {
         type = types.nullOr types.path;
         description = ''
-          Path to a file containing a pbkdf2-sha512 hash in PHC string format.
-          Generate using: nix run github:kiriwalawren/nixflix#genhash -- -k <password> -i 210000 -l 128 -u > /path/to/hash
-        '';
-        example = ''
-          # the format is: $<id>[$<param>=<value>(,<param>=<value>)*][$<salt>[$<hash>]]
-          $PBKDF2-SHA512$iterations=210000$D12C02D1DD15949D867BCA9971BE9987$67E75CDCD14E7F6FDDF96BAACBE9E84E5197FB9FE454FB039F5CD773D7DF558B57DC81DB42B6F7CF0E6B8207A771E5C0EE0DBFD91CE5BAF804FE53F70E61CD2E
+          Path to a file containing the user's password in plain text.
         '';
         default = null;
       };
@@ -329,13 +426,6 @@ with lib; let
         '';
         default = "default";
       };
-      syncPlayAccess = mkOption {
-        type = types.bool;
-        description = "Whether or not this user has access to SyncPlay";
-        example = true;
-        default = false;
-      };
-      # Something to do with chromecast, don't know tbh
       castReceiverId = mkOption {
         type = types.str;
         default = "F007D354";