Add jellyseerr by default

scripts/Common/Software/docker/services/jellyfin/docker-compose.base.yml

@@ -8,6 +8,15 @@ services:
       - ./data/config/jellyfin:/config
       - cache:/cache
       - ./data/media:/media
+  jellyseerr:
+    image: fallenbagel/jellyseerr
+    restart: unless-stopped
+    user: 1337:1337
+    environment:
+      LOG_LEVEL: debug
+    volumes:
+      - /etc/localtime:/etc/localtime:ro
+      - ./data/config/jellyseerr:/app/config
   radarr:
     image: linuxserver/radarr
     restart: unless-stopped

scripts/Common/Software/docker/services/jellyfin/docker-compose.overrides.yml

@@ -3,6 +3,9 @@ services:
     environment: {}
     ports:
       - 127.0.0.1:1337:8096
+  jellyseerr:
+    ports:
+      - 127.0.0.1:1337:5055
   radarr:
     ports:
       - 127.0.0.1:1337:7878

scripts/Common/Software/docker/services/jellyfin/main.fish

@@ -4,6 +4,7 @@ begin
     set -l user jellyfin
     set -l domain media
     set -l server "$domain" ""
+    set -l suggest "jellyseerr"
     set -l servarr radarr sonarr lidarr prowlarr
     set -l flood flood
     set -l service $user
@@ -77,10 +78,11 @@ begin
         printf "%s\0" $server
     end
 
-    function getServiceLocations -V servarr -V flood
+    function getServiceLocations -V suggest -V servarr -V flood
         argparse -i "name=" -- $argv
         printf "%s\0" \
-            "$_flag_name" / "" (
+            "$_flag_name" / "" \
+            "$suggest" "/suggest" "Jellyseerr" (
                 for app in $servarr
                     printf "%s\n" "$app" "/$app" ""
                     printf "%s\n" "$app" "/$app/signalr" ""
@@ -112,7 +114,7 @@ begin
         end
     end
 
-    function getExtraLocationSettings -a domain s location -V service -V servarr
+    function getExtraLocationSettings -a domain s location -V service -V suggest -V servarr
         set -l wsConfig (
             printf "%s\n" \
                 '# Websocket' \
@@ -128,6 +130,36 @@ begin
             else if [ "$location" = /socket ]
                 echo "$wsConfig"
             end
+        else if [ "$s" = "$suggest" ]
+            printf "%s\n" \
+                "" \
+                'set $app \'suggest\';' \
+                "# Remove /suggest path to pass to the app" \
+                'rewrite ^/suggest/?(.*)$ /$1 break;' \
+                "" \
+                "#Redirect location headers" \
+                'proxy_redirect ^ /$app;' \
+                'proxy_redirect /setup /$app/setup;' \
+                'proxy_redirect /login /$app/login;' \
+                "" \
+                "# Sub filters to replace hardcoded paths" \
+                'proxy_set_header Accept-Encoding "";' \
+                'sub_filter_once off;' \
+                'sub_filter_types *;' \
+                'sub_filter \'</head>\' \'<script language="javascript">(()=>{var t="$app";let e=history.pushState;history.pushState=function a(){arguments[2]&&!arguments[2].startsWith("/"+t)&&(arguments[2]="/"+t+arguments[2]);let s=e.apply(this,arguments);return window.dispatchEvent(new Event("pushstate")),s};let a=history.replaceState;history.replaceState=function e(){arguments[2]&&!arguments[2].startsWith("/"+t)&&(arguments[2]="/"+t+arguments[2]);let s=a.apply(this,arguments);return window.dispatchEvent(new Event("replacestate")),s},window.addEventListener("popstate",()=>{console.log("popstate")})})();</script></head>\';' \
+                'sub_filter \'href="/"\' \'href="/$app"\';' \
+                'sub_filter \'href="/login"\' \'href="/$app/login"\'' \
+                'sub_filter \'href:"/"\' \'href:"/$app"\';' \
+                'sub_filter \'\/_next\' \'\/$app\/_next\';' \
+                'sub_filter \'/_next\' \'/$app/_next\';' \
+                'sub_filter \'/api/v1\' \'/$app/api/v1\';' \
+                'sub_filter \'/login/plex/loading\' \'/$app/login/plex/loading\';' \
+                'sub_filter \'/images/\' \'/$app/images/\';' \
+                'sub_filter \'/android-\' \'/$app/android-\';' \
+                'sub_filter \'/apple-\' \'/$app/apple-\';' \
+                'sub_filter \'/favicon\' \'/$app/favicon\';' \
+                'sub_filter \'/logo_\' \'/$app/logo_\';' \
+                'sub_filter \'/site.webmanifest\' \'/$app/site.webmanifest\';'
         else if contains "$s" $servarr
             if string match --regex ".*/signalr^" "$location" >/dev/null
                 echo "$wsConfig"

scripts/Common/Software/docker/services/nextcloud/main.fish

@@ -103,19 +103,45 @@ begin
             printf "%s\0" \
                 "$name" "^~ /browser" "static files" \
                 "$name" "^~ /hosting/discovery" "WOPI discovery URL" \
-                "$name" "^~ /hosting/capabilities" "Capabilities" \
+                "$name" "^~ /hosting/capabilities" Capabilities \
                 "$name" "~ ^/cool/(.*)/ws\$" "main websocket" \
                 "$name" "~ ^/(c|l)ool" "download, presentation and image upload" \
                 "$name" "^~ /cool/adminws" "Admin Console websocket"
         end
     end
 
-    function getServiceLocationConfig -a domain s location -V office -V flood
+    function getServiceLocationConfig -a domain s location -V service -V office -V flood
         if [ "$s" = "$office" ]
             set -l argv $argv[4..]
             getServiceDefaultProxy $domain $s "$location" --scheme https $argv
         else
             getServiceDefaultProxy $argv --path "$location"
+
+            if [ "$s" = "$service" ]
+                printf "%s\n" \
+                    "server_tokens off;" \
+                    "" \
+                    "client_max_body_size 512M;" \
+                    "client_body_timeout 300s;" \
+                    "fastcgi_buffers 64 4K;" \
+                    "" \
+                    "# enable gzip but do not remove ETag headers" \
+                    "gzip on;" \
+                    "gzip_vary on;" \
+                    "gzip_comp_level 4;" \
+                    "gzip_min_length 256;" \
+                    "gzip_proxied expired no-cache no-store private no_last_modified no_etag auth;" \
+                    "gzip_types application/atom+xml text/javascript application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/wasm application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy;" \
+                    "" \
+                    "# Pagespeed is not supported by Nextcloud, so if your server is built" \
+                    "# with the `ngx_pagespeed` module, uncomment this line to disable it." \
+                    "#pagespeed off;" \
+                    "" \
+                    "# The settings allows you to optimize the HTTP2 bandwidth." \
+                    "# See https://blog.cloudflare.com/delivering-http-2-upload-speed-improvements/" \
+                    "# for tuning hints" \
+                    "client_body_buffer_size 512k;"
+            end
         end
     end
 

scripts/Common/Software/docker/services/nextcloud/nginx/web.conf

@@ -11,10 +11,6 @@ http {
     include         mime.types;
     default_type    application/octet-stream;
 
-    types {
-        application/javascript cjs mjs;
-    }
-
     log_format  main    '$remote_addr - $remote_user [$time_local] "$request" '
                         '$status $body_bytes_sent "$http_referer" '
                         '"$http_user_agent" "$http_x_forwarded_for"';
@@ -24,50 +20,75 @@ http {
     server_tokens off;
     keepalive_timeout 65;
 
+    upstream php-handler {
+        server core:9000;
+	    #server unix:/run/php/php8.2-fpm.sock;
+    }
+
     # Set the `immutable` cache control options only for assets with a cache busting `v` argument
     map $arg_v $asset_immutable {
         "" "";
         default "immutable";
     }
 
-    upstream php-handler {
-        server core:9000;
-    }
-
     server {
         listen 80;
 
+        # Path to the root of the domain
+        root /var/www/html;
+
+        # Prevent nginx HTTP Server Detection
+        server_tokens off;
+
+        # HSTS settings
+        # WARNING: Only add the preload option once you read about
+        # the consequences in https://hstspreload.org/. This option
+        # will add the domain to a hardcoded list that is shipped
+        # in all major browsers and getting removed from this list
+        # could take several months.
+        #add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload" always;
+
         # set max upload size and increase upload timeout:
         client_max_body_size 512M;
         client_body_timeout 300s;
         fastcgi_buffers 64 4K;
 
-        # The settings allow you to optimize the HTTP2 bandwith.
+        # Enable gzip but do not remove ETag headers
+        gzip on;
+        gzip_vary on;
+        gzip_comp_level 4;
+        gzip_proxied expired no-cache no-store private no_last_modified no_etag auth;
+        gzip_types application/atom+xml text/javascript application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/wasm application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy;
+
+        # Pagespeed is not supported by Nextcloud, so if your server is built
+        # with the `ngx_pagespeed` module, uncomment this line to disable it.
+        #pagespeed off;
+
+        # The settings allows you to optimize the HTTP2 bandwidth.
         # See https://blog.cloudflare.com/delivering-http-2-upload-speed-improvements/
         # for tuning hints
         client_body_buffer_size 512k;
 
-        # Enable gzip but do not remove ETag headers
+        # HTTP response headers borrowed from Nextcloud `.htaccess`
-        gzip                on;
+        add_header Referrer-Policy                   "no-referrer"       always;
-        gzip_vary           on;
+        add_header X-Content-Type-Options            "nosniff"           always;
-        gzip_comp_level     4;
+        add_header X-Frame-Options                   "SAMEORIGIN"        always;
-        gzip_min_length     256;
+        add_header X-Permitted-Cross-Domain-Policies "none"              always;
-        gzip_proxied        expired no-cache no-store private no_last_modified no_etag auth;
+        add_header X-Robots-Tag                      "noindex, nofollow" always;
-        gzip_types          application/atom+xml text/javascript application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/wasm application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy;
+        add_header X-XSS-Protection                  "1; mode=block"     always;
-
-        # HTTP response headers
-        add_header Referrer-Policy                      "no-referrer"       always;
-        add_header X-Content-Type-Options               "nosniff"           always;
-        add_header X-Frame-Options                      "SAMEORIGIN"        always;
-        add_header X-Permitted-Cross-Domain-Policies    "none"              always;
-        add_header X-Robots-Tag                         "noindex, nofollow" always;
-        add_header X-XSS-Protection                     "1; mode=block"     always;
 
         # Remove X-Powered-By, which is an information leak
         fastcgi_hide_header X-Powered-By;
 
-        # Path to the root of your installation
+	    # Set .mjs and .wasm MIME types
-        root /var/www/html;
+        # Either include it in the default mime.types list
+        # and include that list explicitly or add the file extension
+        # only for Nextcloud like below:
+        include mime.types;
+        types {
+            text/javascript mjs;
+            application/wasm wasm;
+        }
 
         # Specify how to handle directories -- specifying `/index.php$request_uri`
         # here as the fallback means that Nginx always exhibits the desired behaviour
@@ -76,7 +97,7 @@ http {
         # that file is correctly served; if it doesn't, then the request is passed to
         # the front-end controller. This consistent behaviour means that we don't need
         # to specify custom rules for certain paths (e.g. images and other assets,
-        # `/updater`, `/ocm-provider`, `/ocs-provider`), and thus
+        # `/updater`, `/ocs-provider`), and thus
         # `try_files $uri $uri/ /index.php$request_uri`
         # always provides the desired behaviour.
         index index.php index.html /index.php$request_uri;
@@ -98,13 +119,17 @@ http {
         # access it despite the existence of the regex rule
         # `location ~ /(\.|autotest|...)` which would otherwise handle requests
         # for `/.well-known`.
+
         location ^~ /.well-known {
             # The rules in this block are an adaptation of the rules
-            # in `.htaccess` that concern `/.well-known`.
+            # in the Nextcloud `.htaccess` that concern `/.well-known`.
 
             location = /.well-known/carddav { return 301 /remote.php/dav/; }
             location = /.well-known/caldav  { return 301 /remote.php/dav/; }
 
+            location /.well-known/acme-challenge    { try_files $uri $uri/ =404; }
+            location /.well-known/pki-validation    { try_files $uri $uri/ =404; }
+
             # Let Nextcloud's API for `/.well-known` URIs handle all other
             # requests by passing them to the front-end controller.
             return 301 /index.php$request_uri;
@@ -120,7 +145,7 @@ http {
         # to the URI, resulting in a HTTP 500 error response.
         location ~ \.php(?:$|/) {
             # Required for legacy support
-            rewrite ^/(?!index|remote|public|cron|core\/ajax\/update|status|ocs\/v[12]|updater\/.+|ocs-provider\/.+|.+\/richdocumentscode\/proxy) /index.php$request_uri;
+            rewrite ^/(?!index|remote|public|cron|core\/ajax\/update|status|ocs\/v[12]|updater\/.+|ocs-provider\/.+|.+\/richdocumentscode(_arm64)?\/proxy) /index.php$request_uri;
 
             fastcgi_split_path_info ^(.+?\.php)(/.*)$;
             set $path_info $fastcgi_path_info;
@@ -132,8 +157,8 @@ http {
             fastcgi_param PATH_INFO $path_info;
             fastcgi_param HTTPS on;
 
-            fastcgi_param modHeadersAvailable       true;   # Avoid sending the security headers twice
+            fastcgi_param modHeadersAvailable true;         # Avoid sending the security headers twice
-            fastcgi_param front_controller_active   true;   # Enable pretty urls
+            fastcgi_param front_controller_active true;     # Enable pretty urls
             fastcgi_pass php-handler;
 
             fastcgi_intercept_errors on;
@@ -142,35 +167,24 @@ http {
             fastcgi_max_temp_file_size 0;
         }
 
-        # Javascript mimetype fixes for nginx
-        # Note: The block below should be removed, and the js|mjs section should be
-        # added to the block below this one. This is a temporary fix until Nginx
-        # upstream fixes the js mime-type
-        location ~* \.(?:js|mjs)$ {
-            types {
-                text/javascript js mjs;
-            }
-
-            try_files $uri /index.php$request_uri;
-            add_header Cache-Control "public, max-age=15778463, $asset_immutable";
-            access_log off;
-        }
-
         # Serve static files
-        location ~ \.(?:css|svg|gif|png|jpg|ico|wasm|tflite|map|ogg|flac)$ {
+        location ~ \.(?:css|js|mjs|svg|gif|ico|jpg|png|webp|wasm|tflite|map|ogg|flac)$ {
             try_files $uri /index.php$request_uri;
-            add_header Cache-Control "public, max-age=15778463, $asset_immutable";
+            # HTTP response headers borrowed from Nextcloud `.htaccess`
-            access_log off; # Optional: Don't log access to assets
+            add_header Cache-Control                     "public, max-age=15778463$asset_immutable";
-
+            add_header Referrer-Policy                   "no-referrer"       always;
-            location ~ \.wasm$ {
+            add_header X-Content-Type-Options            "nosniff"           always;
-                default_type application/wasm;
+            add_header X-Frame-Options                   "SAMEORIGIN"        always;
-            }
+            add_header X-Permitted-Cross-Domain-Policies "none"              always;
+            add_header X-Robots-Tag                      "noindex, nofollow" always;
+            add_header X-XSS-Protection                  "1; mode=block"     always;
+            access_log off;     # Optional: Don't log access to assets
         }
 
-        location ~ \.woff2?$ {
+        location ~ \.(otf|woff2?)$ {
             try_files $uri /index.php$request_uri;
-            expires 7d;     # Cache-Control policy borrowed from `.htaccess`
+            expires 7d;         # Cache-Control policy borrowed from `.htaccess`
-            access_log off; # Optional: Don't log access to assets
+            access_log off;     # Optional: Don't log access to assets
         }
 
         # Rule borrowed from `.htaccess`