From bde0dc3f07344b573797411bb2034eab1517e9ae Mon Sep 17 00:00:00 2001
From: Jonathan Davies <jpds@protonmail.com>
Date: Sun, 7 Dec 2025 22:20:26 +0000
Subject: [PATCH 1/2] nixos/jellyfin: tests: Log `systemd-analyze` output

---
 nixos/tests/jellyfin.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/nixos/tests/jellyfin.nix b/nixos/tests/jellyfin.nix
index e8fb233bccd5..1e648830f079 100644
--- a/nixos/tests/jellyfin.nix
+++ b/nixos/tests/jellyfin.nix
@@ -154,5 +154,7 @@
 
           if duration.strip() != "5.000000":
               raise Exception("Downloaded video has wrong duration")
+
+      machine.log(machine.succeed("systemd-analyze security jellyfin.service | grep -v '✓'"))
     '';
 }

From 32afd7db7b785f62c74cef0674d3aac02641d44e Mon Sep 17 00:00:00 2001
From: Jonathan Davies <jpds@protonmail.com>
Date: Sun, 7 Dec 2025 22:20:50 +0000
Subject: [PATCH 2/2] nixos/jellyfin: Add more lockdown options

---
 nixos/modules/services/misc/jellyfin.nix | 20 ++++++--------------
 1 file changed, 6 insertions(+), 14 deletions(-)

diff --git a/nixos/modules/services/misc/jellyfin.nix b/nixos/modules/services/misc/jellyfin.nix
index 89640b9a3211..b1ea8082ee11 100644
--- a/nixos/modules/services/misc/jellyfin.nix
+++ b/nixos/modules/services/misc/jellyfin.nix
@@ -129,6 +129,7 @@ in
           ];
 
           # Security options:
+          CapabilityBoundingSet = [ "" ];
           NoNewPrivileges = true;
           SystemCallArchitectures = "native";
           # AF_NETLINK needed because Jellyfin monitors the network connection
@@ -141,11 +142,15 @@ in
           RestrictNamespaces = !config.boot.isContainer;
           RestrictRealtime = true;
           RestrictSUIDSGID = true;
+          ProcSubset = "pid";
           ProtectControlGroups = !config.boot.isContainer;
+          ProtectClock = true;
           ProtectHostname = true;
           ProtectKernelLogs = !config.boot.isContainer;
           ProtectKernelModules = !config.boot.isContainer;
           ProtectKernelTunables = !config.boot.isContainer;
+          ProtectProc = "invisible";
+          ProtectSystem = true;
           LockPersonality = true;
           PrivateTmp = !config.boot.isContainer;
           # needed for hardware acceleration
@@ -154,21 +159,8 @@ in
           RemoveIPC = true;
 
           SystemCallFilter = [
-            "~@clock"
-            "~@aio"
-            "~@chown"
-            "~@cpu-emulation"
-            "~@debug"
-            "~@keyring"
-            "~@memlock"
-            "~@module"
-            "~@mount"
-            "~@obsolete"
+            "@system-service"
             "~@privileged"
-            "~@raw-io"
-            "~@reboot"
-            "~@setuid"
-            "~@swap"
           ];
           SystemCallErrorNumber = "EPERM";
         };