# Jellyfin DEV — second instance for theme/branding experimentation
# Deploy path on nullstone: /opt/docker/jellyfin-dev/
# Domain: dev.arrflix.s8n.ru (LAN-only via Pi-hole local DNS + no-guest middleware)
#
# Purpose:
# - Isolated playground for trying themes (Cineplex, ElegantFin, NeutralFin, ...)
#   without touching the live arrflix.s8n.ru that real users (marco, house, guest, 5)
#   are watching.
# - Same media library mounted READ-ONLY so dev sees the same titles but cannot
#   mutate the on-disk library.
# - Separate config/cache so first-run wizard, accounts and branding live here only.
# - LAN-only: no-guest middleware on router; do NOT publish to WAN.
#
# Image pinned to 10.10.3 to match prod for theme parity. Bump prod first, then
# match here, never the other way around.

services:
  jellyfin-dev:
    image: jellyfin/jellyfin:10.10.3
    container_name: jellyfin-dev
    restart: unless-stopped
    user: "1000:1000"
    userns_mode: "host"
    environment:
      - TZ=Europe/London
      - JELLYFIN_PublishedServerUrl=https://dev.arrflix.s8n.ru
    volumes:
      - /home/docker/jellyfin-dev/config:/config
      - /home/docker/jellyfin-dev/cache:/cache
      - /home/user/media:/media:ro
    networks:
      - proxy
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=proxy"
      - "traefik.http.routers.jellyfin-dev.rule=Host(`dev.arrflix.s8n.ru`)"
      - "traefik.http.routers.jellyfin-dev.entrypoints=websecure"
      - "traefik.http.routers.jellyfin-dev.tls=true"
      - "traefik.http.routers.jellyfin-dev.tls.certresolver=letsencrypt"
      - "traefik.http.routers.jellyfin-dev.middlewares=security-headers@file,no-guest@file"
      - "traefik.http.services.jellyfin-dev.loadbalancer.server.port=8096"

networks:
  proxy:
    external: true