ervices:
  jellyfin:
    image: lscr.io/linuxserver/jellyfin:latest
    container_name: jellyfin
    group_add:
      - "992"  # Verified GID for the 'render' group on KDE Neon
    deploy:
      resources:
        limits:
          cpus: '4.0'
          memory: 6G
        reservations:
          memory: 1G
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=America/Chicago
      #- DOCKER_MODS=linuxserver/mods:jellyfin-opencl-intel
      - LIBVA_DRIVER_NAME=iHD
    volumes:
      - ./config:/config
      - /home/krod/containers/servarr/data/media/movies:/data/movies
      - /home/krod/containers/servarr/data/media/shows:/data/shows
      - /home/krod/containers/servarr/data/media/music:/data/music
    devices:
      - /dev/dri/renderD128:/dev/dri/renderD128
    ports:
      - 8096:8096
      - 7359:7359/udp
      - 1900:1900/udp
    restart: unless-stopped
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=proxy"
      - "traefik.http.routers.jellyfin.entrypoints=web"
      - "traefik.http.routers.jellyfin.rule=Host(`jellyfin.example.duckdns.org`)"
      - "traefik.http.middlewares.jellyfin-https-redirect.redirectscheme.scheme=https"
      - "traefik.http.routers.jellyfin.middlewares=jellyfin-https-redirect"
      - "traefik.http.routers.jellyfin-secure.entrypoints=websecure"
      - "traefik.http.routers.jellyfin-secure.rule=Host(`jellyfin.example.duckdns.org`)"
      - "traefik.http.routers.jellyfin-secure.tls=true"
      - "traefik.http.routers.jellyfin-secure.tls.certresolver=letsencrypt"
      - "traefik.http.routers.jellyfin-secure.middlewares=default-security-headers@file"
      - "traefik.http.routers.jellyfin-secure.service=jellyfin-svc"
      - "traefik.http.services.jellyfin-svc.loadbalancer.server.port=8096"
    networks:
      - proxy
    security_opt:
      - no-new-privileges:true

networks:
  proxy:
    external: true