jellyfin: forward client IP headers from caddy and cloudflare

docs/CHANGELOG.md

@@ -2,6 +2,10 @@
 
 ## 2026-09-07
 
+- **Configured real client IP forwarding for Jellyfin reverse proxy**:
+  - Added a `map` handler to Jellyfin's Caddy route in `platforms/nixos/modules/nmasur/presets/services/jellyfin.nix` to resolve `{client_ip}` using Cloudflare's `CF-Connecting-IP` header when available, falling back to `{http.request.remote.host}` for direct local LAN connections.
+  - Configured `reverse_proxy.headers.request.set` to forward `X-Real-IP`, `X-Forwarded-For`, and `X-Forwarded-Proto` with the resolved client IP and request scheme to Jellyfin.
+
 - **Configured OpenID Connect (OIDC) authentication for Nextcloud**:
   - Added `user_oidc` to `services.nextcloud.extraApps`.
   - Added secret management for `nextcloud-oidc-secret.age` via `secrets.nextcloud-oidc-secret` with owner `nextcloud` and group `nextcloud` (0440).

platforms/nixos/modules/nmasur/presets/services/jellyfin.nix

@@ -44,9 +44,27 @@ in
       {
         match = [ { host = [ hostnames.stream ]; } ];
         handle = [
+          # Resolve client IP: use Cloudflare's CF-Connecting-IP if present, otherwise remote host
+          {
+            handler = "map";
+            source = "{http.request.header.CF-Connecting-IP}";
+            destinations = [ "{client_ip}" ];
+            defaults = [ "{http.request.remote.host}" ];
+            mappings = [
+              {
+                input_regexp = "^(.+)$";
+                outputs = [ "\${1}" ];
+              }
+            ];
+          }
           {
             handler = "reverse_proxy";
             upstreams = [ { dial = "localhost:8096"; } ];
+            headers.request.set = {
+              "X-Real-IP" = [ "{client_ip}" ];
+              "X-Forwarded-For" = [ "{client_ip}" ];
+              "X-Forwarded-Proto" = [ "{http.request.scheme}" ];
+            };
           }
         ];
       }