roles/jellyfin/tasks/jellyfin.yml

@@ -11,11 +11,13 @@
     mode: 0755
   tags:
     - letsencrypt-certs
+    - jellyfin-certs
   notify: reload nginx
   vars:
     prediff_cmd: echo
   with_items:
     - "{{ jellyfin_url }}"
+    - "{{ jellyfin_url_alt }}"
 
 - name: install packages for hardware acceleration
   apt:

roles/jellyfin/templates/01-jellyfin.j2

@@ -4,6 +4,40 @@
  # map $request_uri $h264Level { ~(h264-level=)(.+?)& $2; }
  # map $request_uri $h264Profile { ~(h264-profile=)(.+?)& $2; } #}
 
+server {
+    listen {{ jellyfin_nginx_listen_port }} ssl http2;
+    {% if inventory_hostname in wg_clients -%}
+    listen {{ wg_clients[inventory_hostname].ip }}:{{ jellyfin_nginx_listen_port }} ssl http2;
+    {% endif -%}
+
+    include /etc/nginx/sudo-known.conf;
+    include listen-proxy-protocol.conf;
+    server_name {{ jellyfin_url_alt }} www.{{ jellyfin_url_alt }};
+
+    client_max_body_size 20M;
+
+    access_log /var/log/nginx/access_{{ jellyfin_url_alt }}.log main;
+    error_log /var/log/nginx/error_{{ jellyfin_url_alt }}.log warn;
+
+    ssl_certificate /usr/local/etc/certs/{{ jellyfin_url_alt }}/fullchain.pem;
+    ssl_certificate_key /usr/local/etc/certs/{{ jellyfin_url_alt }}/privkey.pem;
+
+    location / {
+        proxy_pass https://localhost;
+        proxy_set_header Host {{ jellyfin_url }};
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header X-Forwarded-Protocol $scheme;
+        proxy_set_header X-Forwarded-Host $http_host;
+
+        proxy_redirect https://{{ jellyfin_url }}/web/ https://{{ jellyfin_url_alt }}/web/;
+
+        proxy_set_header Accept-Encoding "";
+    }
+
+}
+
 server {
     listen {{ jellyfin_nginx_listen_port }} ssl http2;
     {% if inventory_hostname in wg_clients -%}