zkk / VPS Jellyfin

---

apt install extrepo
extrepo enable jellyfin
apt install jellyfin-server
apt install jellyfin-web
apt install jellyfin-ffmpeg
systemctl enable jellyfin
systemctl start jellyfin

server {
		listen 80;
		listen [::]:80;
		server_name jellyfin.max73.it;

		## The default `client_max_body_size` is 1M, this might not be enough for some posters, etc.
		client_max_body_size 20M;

		# use a variable to store the upstream proxy
		# in this example we are using a hostname which is resolved via DNS
		# (if you aren't using DNS remove the resolver line and change the variable to point to an IP address e.g `set $jellyfin 127.0.0.1`)
		set $jellyfin jellyfin;
		# resolver 127.0.0.1 valid=30s;

		# Security / XSS Mitigation Headers
		# NOTE: X-Frame-Options may cause issues with the webOS app
		add_header X-Frame-Options "SAMEORIGIN";
		add_header X-XSS-Protection "0"; # Do NOT enable. This is obsolete/dangerous
		add_header X-Content-Type-Options "nosniff";

		# Permissions policy. May cause issues with some clients
		add_header Permissions-Policy "accelerometer=(), ambient-light-sensor=(), battery=(), bluetooth=(), camera=(), clipboard-read=(), display-capture=(), document-domain=(), encrypted-media=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), payment=(), publickey-credentials-get=(), serial=(), sync-xhr=(), usb=(), xr-spatial-tracking=()" always;

		# Content Security Policy
		# See: https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP
		# Enforces https content and restricts JS/CSS to origin
		# External Javascript (such as cast_sender.js for Chromecast) must be whitelisted.
		# NOTE: The default CSP headers may cause issues with the webOS app
		add_header Content-Security-Policy "default-src https: data: blob: ; img-src 'self' https://* ; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' https://www.gstatic.com https://www.youtube.com blob:; worker-src 'self' blob:; connect-src 'self'; object-src 'none'; frame-ancestors 'self'";

		location / {
				# Proxy main Jellyfin traffic
				proxy_pass http://$jellyfin:8096;
				proxy_set_header Host $host;
				proxy_set_header X-Real-IP $remote_addr;
				proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
				proxy_set_header X-Forwarded-Proto $scheme;
				proxy_set_header X-Forwarded-Protocol $scheme;
				proxy_set_header X-Forwarded-Host $http_host;

				# Disable buffering when the nginx proxy gets very resource heavy upon streaming
				proxy_buffering off;
		}

		location /socket {
				# Proxy Jellyfin Websockets traffic
				proxy_pass http://$jellyfin:8096;
				proxy_http_version 1.1;
				proxy_set_header Upgrade $http_upgrade;
				proxy_set_header Connection "upgrade";
				proxy_set_header Host $host;
				proxy_set_header X-Real-IP $remote_addr;
				proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
				proxy_set_header X-Forwarded-Proto $scheme;
				proxy_set_header X-Forwarded-Protocol $scheme;
				proxy_set_header X-Forwarded-Host $http_host;
		}
}

sudo certbot --nginx -d jellyfin.max73.it
ln -s /etc/nginx/sites-available/jellyfin /etc/nginx/sites-enabled
systemctl reload nginx

apt install rclone

rclone config

No remotes found - make a new one
n) New remote
s) Set configuration password
q) Quit config
n/s/q> n

name> googledrive # nome

Option Storage.
Type of storage to configure.
Enter a string value. Press Enter for the default ("").
Choose a number from below, or type in your own value.
...
Storage> 18

Option client_id.
Google Application Client Id
Setting your own is recommended.
See https://rclone.org/drive/#making-your-own-client-id for how to create your own.
If you leave this blank, it will use an internal key which is low performance.
Enter a string value. Press Enter for the default ("").
client_id> <ENTER>
Option client_secret.
OAuth Client Secret.
Leave blank normally.
Enter a string value. Press Enter for the default ("").
client_secret> <ENTER>

Choose a number from below, or type in your own value.
 1 / Full access all files, excluding Application Data Folder.
   \ "drive"
 2 / Read-only access to file metadata and file contents.
   \ "drive.readonly"
   / Access to files created by rclone only.
 3 | These are visible in the drive website.
   | File authorization is revoked when the user deauthorizes the app.
   \ "drive.file"
   / Allows read and write access to the Application Data folder.
 4 | This is not visible in the drive website.
   \ "drive.appfolder"
   / Allows read-only access to file metadata but
 5 | does not allow any access to read or download file content.
   \ "drive.metadata.readonly"
scope> 1

Option root_folder_id.
ID of the root folder.
Leave blank normally.
Fill in to access "Computers" folders (see docs), or for rclone to use
a non root folder as its starting point.
Enter a string value. Press Enter for the default ("").
root_folder_id> <ENTER>

Option service_account_file.
Service Account Credentials JSON file path.
Leave blank normally.
Needed only if you want use SA instead of interactive login.
Leading `~` will be expanded in the file name as will environment variables such as `${RCLONE_CONFIG_DIR}`.
Enter a string value. Press Enter for the default ("").
service_account_file> <ENTER>

Edit advanced config?
y) Yes
n) No (default)
y/n> n

Use auto config?
 * Say Y if not sure
 * Say N if you are working on a remote or headless machine
y) Yes (default)
n) No
y/n> n

Option config_token.
For this to work, you will need rclone available on a machine that has
a web browser available.
For more help and alternate methods see: https://rclone.org/remote_setup/
Execute the following on the machine with the web browser (same rclone
version recommended):
	rclone authorize "googledrive"
Then paste the result.
Enter a value.
config_token>

rclone authorize "googledrive"
If your browser doesn't open automatically go to the following link: http://127.0.0.1:53682/auth
Log in and authorize rclone for access
Waiting for code...
Got code
Paste the following into your remote machine --->
SECRET_TOKEN
<---End paste

config_token> SECRET_TOKEN
--------------------
[acd12]
client_id =
client_secret =
token = SECRET_TOKEN
--------------------
y) Yes this is OK
e) Edit this remote
d) Delete this remote
y/e/d>y

Configure this as a Shared Drive (Team Drive)?
y) Yes
n) No (default)
y/n> n

y) Yes this is OK
e) Edit this remote
d) Delete this remote
y/e/d> y

mkdir /var/www/media/videos_movies
mkdir /mnt/rclonecache
rclone mount --allow-other googledrive:hdd/movies /var/www/media/videos_movies/ &
fusermount -u /var/www/media/videos_movies

[Unit]
Description=RClone Service
Wants=network-online.target
After=network-online.target
AssertPathIsDirectory=/var/www/media/videos_movies

[Service]
Type=notify
Environment=RCLONE_CONFIG=/root/.config/rclone/rclone.conf
RestartSec=10
ExecStart=/usr/bin/rclone mount \
													--allow-other \
													--dir-cache-time 5000h \
													--syslog \
													--poll-interval 10s \
													--user-agent GoogleDrive \
													--cache-dir=/mnt/rclonecache \
													--vfs-cache-mode full \
													--volname googledrive \
													--vfs-cache-max-size 10G \
													--vfs-read-chunk-size 128M \
													--vfs-read-ahead 2G \
													--vfs-cache-max-age 5000h \
													--bwlimit-file 100M \
													--uid 102 \
													--gid 111 \
													googledrive:hdd/movies /var/www/media/videos_movies

ExecStop=/bin/fusermount -uz /var/www/media/videos_movies
Restart=on-failure
#User=jellyfin
#Group=jellyfin

[Install]
WantedBy=multi-user.target

cat /etc/passwd | grep jellyfin

systemctl daemon-reload
systemctl enable rclone
systemctl start rclone
systemctl status rclone