jellyfin: Deploy Jellyfin media server

Jellyfin is a multimedia library manager. Clients can browse and stream
music, movies, and TV shows from the server and play them locally
(including in the browser).

roles/jellyfin/templates/jellyfin.container.j2

@@ -0,0 +1,39 @@
+[Unit]
+Description=Jellyfin Media Server
+Wants=network.target
+After=network.target
+
+[Container]
+Image={{ jellyfin_container_image }}:{{ jellyfin_version }}
+#UserNS=keep-id
+User=201
+Group=201
+EnvironmentFile=/etc/sysconfig/jellyfin
+Volume=/var/lib/jellyfin:/config:rw,z
+Volume=/var/cache/jellyfin:/cache:rw,z
+{% for path in jellyfin_media_dirs %}
+Volume={{ path }}:/media/{{ path | basename }}:ro
+{% endfor %}
+Network=host
+NoNewPrivileges=yes
+
+[Service]
+#MemoryDenyWriteExecute=yes
+PrivateTmp=yes
+ProtectClock=yes
+ProtectHome=yes
+ProtectKernelLogs=yes
+ProtectKernelModules=yes
+ProtectKernelTunables=yes
+ProtectProc=invisible
+ProtectSystem=strict
+ReadWritePaths=/var/lib/jellyfin
+ReadWritePaths=/var/lib/containers/storage
+ReadWritePaths=/var/cache/jellyfin
+RestrictRealtime=yes
+RestrictSUIDSGID=yes
+SuccessExitStatus=0 143
+UMask=0077
+
+[Install]
+WantedBy=multi-user.target