add knecht

docs/jellyfin.md

@@ -0,0 +1,42 @@
+# Jellyfin
+
+**Purpose:** Self-hosted media server for streaming TV and movies from the local library.
+
+| Property     | Value                                                                               |
+| ------------ | ----------------------------------------------------------------------------------- |
+| Image        | `lscr.io/linuxserver/jellyfin:latest`                                               |
+| Web UI       | <https://jellyfin.home.jens.pub>                                                    |
+| Compose file | [`../services/jellyfin/docker-compose.yml`](../services/jellyfin/docker-compose.yml) |
+
+---
+
+## Environment Variables
+
+| Variable      | Description                              |
+| ------------- | ---------------------------------------- |
+| `PUID`        | Host user ID for volume ownership        |
+| `PGID`        | Host group ID for volume ownership       |
+| `TZ`          | Timezone (e.g. `Europe/Berlin`)          |
+| `TV_PATH`     | Host path to TV library                  |
+| `MOVIES_PATH` | Host path to movies library              |
+
+---
+
+## Volumes
+
+| Volume            | Mount             | Purpose                        |
+| ----------------- | ----------------- | ------------------------------ |
+| `jellyfin_config` | `/config`         | Database, metadata, settings   |
+| `jellyfin_cache`  | `/cache`          | Transcoding cache              |
+| `${TV_PATH}`      | `/media/tv:ro`    | TV library (read-only)         |
+| `${MOVIES_PATH}`  | `/media/movies:ro`| Movies library (read-only)     |
+
+Media is mounted read-only — Jellyfin only reads, Sonarr/Radarr manage the files.
+
+---
+
+## Networks
+
+- `proxy` (external) — Traefik routes `jellyfin.home.jens.pub` → port `8096`
+
+Jellyfin is intentionally **not** routed through the VPN — it serves local clients and doesn't need outbound anonymity.