Media#

Media services can be enabled on a host by setting tsunaminoai.media.<type>.enable = true; in the host configuration. Any type will add the nix-media-sops user to the host and mount the media share.

All four apps below run natively on ereshkigal and bind to loopback. Family access is via Cloudflare Zero Trust — see Family Media. Where a ts.net HTTPS port is listed it is an admin-only fallback; apps whose Cloudflare origin fully replaces it (Jellyfin) no longer have one.

Media Services#

Video — media.server.video#

  • Jellyfin (:8096 loopback) — the only ingress is watch.inaba.network; the duplicate tailnet vhost on :8920 was retired in #177. SSO via jellyfin-plugin-sso (OIDC).

Music — media.server.audio#

Audiobooks — media.server.audio#

Live TV — media.weatherChannel#

  • WeatherStar 4000 (ws4kp :12821 / ws4channels :9798) — a 1990s Weather Channel recreation published to Jellyfin Live TV as an M3U tuner plus an XMLTV guide. Registered automatically by jellyfin-provision.

Books — media.server.books#

  • Kavita (:5000) — family: books.inaba.network. In-browser epub/pdf/cbz reader with native OIDC SSO; points at the eBooks tree on the media share.
  • LanRaragi / Komga — manga/comics, run on the external voile NAS (dashboard tiles only, not flake-provisioned).

Note

media.server.books is now backed by Kavita (modules/nixos/media/kavita.nix). Navidrome and Audiobookshelf state lives under /var/lib and is backed up via borgmatic; libraries point at /mnt/voile/Inaba/…/yunohost.multimedia/share.

Acquisition#

Warning

Turning on acquisition services will enable the host to download media from the internet and opens the host to potential intrusion. Yukari is set up to block malicious traffic, but it is not foolproof.

Egress scoping (#268)

Acquisition egress is confined to a network namespace whose only route is a dedicated tailscaled using the myon exit node (tailscale/netns-exit.nix + servarr/vpn.nix). qBittorrent, Prowlarr, and FlareSolverr live in the namespace; an in-namespace nftables kill switch means tailscale down ⇒ torrents stall rather than leaking via the direct path. The host’s own egress goes out the LAN directly — myon going down no longer takes cloudflared/PKI/monitoring with it. The apps stay reachable at their usual 127.0.0.1 ports via systemd-socket-proxyd republishing.

If tsunaminoai.servarr.enable = true; is set, the host will also have the following services:

Media Server module concept#

flowchart RL subgraph Int["Internet"] Trackers["Trackers"] Myon["myon.armadillo-banfish.ts.net"] Peers["Peers"] end subgraph V["Voile - /mnt/voile/Inaba"] subgraph I["Media Share - ./yunohost.multimedia"] Music Video TV["TV Shows"] subgraph Video["Video"] Anime["Anime"] Movies["Movies"] TV["TV Shows"] end subgraph books["eBooks"] Manga["Manga"] LN["Light Novels"] Audiobooks Fiction Textbooks end Downloads end subgraph Aquisition["Media Acquisition - ./yunohost.app"] sonarr --- Anime sonarr --- TV sonarr <--> Downloads radarr --- Movies radarr <--> Downloads lidarr --- Music lidarr <--> Downloads readarr --- books readarr <--> Downloads qBittorrent <--> Downloads prowlarr <--> Myon <--> Trackers qBittorrent <--> Myon <--> Peers end subgraph M[Media Server] Jellyfin --- Video Navidrome --- Music AudioBookShelf --- Audiobooks Kavita --- books end end
  • Family Media — the family-facing access guide.
  • Weather Channel — the retro live-TV channel in Jellyfin.
  • myon — the exit node the acquisition netns uses.
  • TLMC v5.5 — end-to-end music acquisition: torrent, RAR extraction, beets index, metadata enrichment.