---
# Portable config — values that hold regardless of where Jellyfin runs.
# Platform-specific values (filesystem paths, the PUID/PGID the container
# writes as) live in ../ansible/<platform>/vars.yml and are merged over these
# at deploy time.
env_defaults:
  # LinuxServer tags are the upstream Jellyfin version plus their own build
  # suffix (e.g. `10.10.7-ls145`), which can't be derived from the release
  # number — read it off the registry and replace this with a full tag before
  # relying on this in anything but a throwaway test. `latest` for now, same
  # as PROWLARR_VERSION in ../../arr/common/vars.yml — check
  # https://github.com/linuxserver/docker-jellyfin/pkgs/container/jellyfin
  JELLYFIN_VERSION: latest

  # Published port. 8096 is upstream's default and what the container listens
  # on internally; kept the same on the host so the WebUI label, the LAN URL
  # and the docs all read alike.
  JELLYFIN_HTTP_PORT: "8096"

  # No Vault secrets today — Jellyfin's admin account is set up through its
  # own first-run web wizard rather than an env var, and there's no API key
  # or session secret this deployment pins the way Shelfarr's
  # SECRET_KEY_BASE or Prowlarr's PROWLARR_API_KEY are. The compose_stack
  # role still looks up `homelab/jellyfin` unconditionally (see
  # ../../arr/ansible/unraid/vars.yml's equivalent note — there isn't one,
  # because arr has real secrets; this is the first app that doesn't), so the
  # KV path has to exist before the first deploy even if it holds nothing —
  # `vault kv put kv/homelab/jellyfin placeholder=unused` is enough. Revisit
  # if a plugin (hardware-key SSO, a remote-access token) needs one later.

  # STACK_ICON is supplied by the compose_stack role, from a committed
  # ../ansible/unraid/icon.png — not set here, and none is committed yet, so
  # the Docker page shows Unraid's placeholder until one is added. Uncomment
  # to use a hosted icon instead:
  #
  #   STACK_ICON: https://example.org/jellyfin.png