By: Ammar Nanjiani <ammar.nanjiani@gmail.com>
feat(jellyfin): host media archive on theoden, fronted by traefik
Native services.jellyfin (nixarr not needed for LAN-only use; the Aug 2025
nixarr experiment was retired for VPN reasons and its jellyfin extras are
public-exposure plumbing). Replaces the stale media->homeserver_ip DNS
record with jellyfin->traefik LB.
- hosts/servers/theoden/jellyfin.nix: services.jellyfin on :8096,
jellyfin user in storage group for /mnt/storage/movies read
- k8s/apps/jellyfin/: romm-pattern Service+manual Endpoints to
192.168.1.27, bifrost-pattern dual IngressRoute + certs
(jellyfin.lan via lan-ca, jellyfin.dimensiondoor.xyz via letsencrypt)
- adguard.nix: jellyfin.lan rewrite -> 192.168.1.52
- htpc.nix: kodi-gbm withPackages + jellyfin addon (rivendell)
- dns.tf: media record -> jellyfin record
Leftovers cleaned on theoden: /mnt/storage/{jellyfin,arr-data} (44K
husks + dead Mullvad wg key) removed.