Dustin C. Hatch
2864a4185c
In order to enable authentication using LDAP over TLS in Jellyfin, we need to expose the CA certificate that issues the LDAP server certificates to the container.
45 lines
1.0 KiB
Django/Jinja
45 lines
1.0 KiB
Django/Jinja
[Unit]
|
|
Description=Jellyfin Media Server
|
|
Wants=network.target
|
|
After=network.target
|
|
|
|
[Container]
|
|
Image={{ jellyfin_container_image }}:{{ jellyfin_version }}
|
|
#UserNS=keep-id
|
|
User=201
|
|
Group=201
|
|
EnvironmentFile=/etc/sysconfig/jellyfin
|
|
Volume=/var/lib/jellyfin:/config:rw,z
|
|
Volume=/var/cache/jellyfin:/cache:rw,z
|
|
{% for path in jellyfin_media_dirs %}
|
|
Volume={{ path }}:/media/{{ path | basename }}:ro
|
|
{% endfor %}
|
|
{% if jellyfin_ldap_ca_cert|d %}
|
|
Volume={{ jellyfin_ldap_ca_cert }}:/config/ldap-ca.crt:ro
|
|
{% endif %}
|
|
Network=host
|
|
NoNewPrivileges=yes
|
|
|
|
[Service]
|
|
Restart=always
|
|
#MemoryDenyWriteExecute=yes
|
|
PrivateTmp=yes
|
|
ProtectClock=yes
|
|
ProtectHome=yes
|
|
ProtectKernelLogs=yes
|
|
ProtectKernelModules=yes
|
|
ProtectKernelTunables=yes
|
|
ProtectProc=invisible
|
|
ProtectSystem=strict
|
|
ReadWritePaths=/var/lib/jellyfin
|
|
ReadWritePaths=/var/lib/containers/storage
|
|
ReadWritePaths=/var/cache/jellyfin
|
|
TemporaryFileSystem=/etc/containers/networks
|
|
RestrictRealtime=yes
|
|
RestrictSUIDSGID=yes
|
|
SuccessExitStatus=0 143
|
|
UMask=0077
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|