nixflix

Breaking

• Web UIs now bind to 127.0.0.1 (loopback) by default, so services are no longer reachable from your network unless you expose them explicitly: set the service's bind option to 0.0.0.0 or your LAN IP (e.g. nixflix.[radarr|sonarr|lidarr|sonarr-anime|prowlarr].config.hostConfig.bindAddress, nixflix.jellyfin.network.localNetworkAddresses, nixflix.navidrome.settings.Address, nixflix.torrentClients.qbittorrent.serverConfig.Preferences.WebUI.Address, nixflix.usenetClients.sabnzbd.settings.misc.host, nixflix.slskd.settings.web.ip_address), or put the built-in reverse proxy in front (nixflix.nginx.enable / nixflix.caddy.enable). Services confined to the VPN namespace keep binding to the namespace address. (#364)

Changed

• Jellyfin plugins whose targetAbi is older than 12 are no longer excluded on Jellyfin 12+. targetAbi is now treated purely as the minimum supported Jellyfin version, matching Jellyfin's own check, which grows the plugins available under nixflix.jellyfin.plugins from 179 to 330
• The bundled Jellyfin plugin list now keeps the newest 10 versions of each plugin, and for each version only the build with the highest targetAbi that the pinned Jellyfin supports
• The Jellyfin plugin update script now hashes plugin versions in parallel (one job per CPU, override with PLUGIN_PREFETCH_CONCURRENCY), reports progress as it goes, and avoids repeated manifest parsing

Added

• nixflix.jellyfin.users.<name>.policy.enabledFolders to restrict a user to specific Jellyfin libraries by name instead of giving every user access to all of them. policy.enableAllFolders now defaults to false when enabledFolders is set. Note that a user with enableAllFolders = false and mutable = false now has their library selection overwritten from Nix on every rebuild
• nixflix.jellyfin.liveTv to declare Live TV M3U tuners (IPTV playlists) and XMLTV guides (#391)
• nixflix.usenetClients.sabnzbd.settings.rss to declare SABnzbd RSS feeds and their filters. Feed URLs can be _secret files. (#389)
• Added Navidrome plugin support (#372)
• nixflix.seerr now asserts that the Seerr package in use is 3.5.0 or newer, failing evaluation with an actionable message instead of a bare seerr-setup.service status=22 during activation. nixflix.seerr.package defaults to pkgs.seerr from your own nixpkgs rather than the nixpkgs nixflix pins, so this applies whether or not you set the option — update your nixpkgs, or set nixflix.seerr.package to a 3.5.0+ build. Seerr library calls also report their HTTP status on failure rather than exiting on a bare curl -f code
• nixflix.<sonarr|sonarr-anime|radarr|lidarr>.config.metadata to configure metadata consumers (Settings → Metadata), e.g. Plex series match files and episode mappings (#373)

Deprecated

• relaxVersionCheck in nixflix.lib.jellyfinPlugins.fromRepo no longer has any effect and prints an evaluation warning when set. Remove it from your configuration

Fixed

• Radarr, Sonarr, Sonarr Anime, Lidarr, Prowlarr, Seerr and Maintainerr data directories are now 0700 instead of 0755. Their API keys (config.xml, Seerr's settings.json, Maintainerr's database) were readable by every local user: the *arr units run with UMask=0002, so config.xml was 0664. Existing installs are fixed on the next activation. (#392)
• SABnzbd: a _secret inside a list value was written triple-quoted, which ConfigObj cannot parse in a list: two secrets were silently read as one garbled string, and a single one with a trailing comma failed to parse. List items now use a list-safe quote. ([#389](https://githu

Changed

• Made Nix module options more discoverable in docs (#345)
• Updated nixflix.seerr.externalUrlScheme deprecation instructions
• Radarr's default Recyclarr quality profile now sets min_format_score to 180 instead of 1000, to prefer media acquisition (#305)

Added

• Allow VPN namespace to be overriden per service (#336)
• Soulseek downloader - slskd (#336)
• Notif Service for configuring notification connectors in Starr apps (#324)
• nixflix.prowlarr.config.indexers.*.schemaName to set a custom indexer display name and configure multiple indexers from the same schema (#353)
• Automatically set default package for most Jellyfin plugins, also removing the Universal Plugin Repository from the system configuration. (#339). If you previously enabled a plugin just by setting a package, you'll now want to just set enable = true; instead.

Fixed

• Fix Recyclarr Custom Quality Profile causes Seerr to fail on first run (#367)
• Fix Starr apps failing to hardlink downloads into media directories by removing leftover per-directory ReadWritePaths bind mounts and setting qBittorrent's UMask to 0002 (#347). Torrents downloaded before this fix keep mode 0644. To make them hardlinkable, run sudo chmod -R g+w /data/downloads/torrent once (adjust the path if you changed nixflix.torrentClients.qbittorrent.downloadsDir).
• Fix radarr-config failing to apply host settings on Radarr 6.4.4 by sending allowedHosts in the host config payload (#355)
• Fix redundant group configuration causing mediaUsers failure (#341)
• Fix jellyfin auto ignore empty folders (#333)
• Added missing websocket support to arrs nginx config (#354)
• Resolve _secret references in additional Prowlarr indexer fields instead of sending them unresolved (#353)

Changed

• Default theme is set to "catppuccin-mocha".

Added

• Added Jellyfin Universal Plugin Repo manifest so users don't have to add plugin manifests manually anymore (#321)
• Lidarr metadata profile overrides service that creates, updates, and deletes metadata profiles to match nixflix.lidarr.config.metadataProfiles (#293)
• Lidarr quality profile overrides service that creates, updates, and deletes quality profiles to match nixflix.lidarr.config.qualityProfiles (#294)
• Navidrome (#296)

Fixed

• fix forceJellyfinIgnore not correctly finding series' paths
• fix(arr-common): silent failure of arr-config services not generating if username & password were both null (#311)
• fix(seer/sonarr): requirement on radarr and require seerr-libraries like seer/radarr (#311)
• fix navidrome dependency on serviceDependencies (#306)
• fix seerr sonarr activeDirectory default resolving host config (#283)
• fix *arr rootfolders oneshot racing app startup (#286)
• fix *arr config.hostConfig auth/port/urlBase values being ignored in favor of hardcoded settings env vars (#289)
• fix Jellyfin crash-looping on boot when a stale TranscodingTempPath in encoding.xml points at an inaccessible path after cacheDir/encoding.transcodingTempPath changes (#291)
• fix _secret refs nested inside lists being silently dropped and POSTed as null, e.g. the Jellyfin Webhook plugin's GenericOptions (#302)

Breaking

• Jellyfin manifest is pulled from this repository instead of a separate one.
  • I accidentally deleted the old repository instead of archiving it, updates to 3.0.0 are required.