Change:
{ config, pkgs, lib, ... }: <del> with lib; </del> let <ins> inherit (lib) mkIf getExe maintainers mkEnableOption mkOption mkPackageOption; inherit (lib.types) str path bool; </ins> cfg = config.services.jellyfin; in { options = { services.jellyfin = { <del> enable = mkEnableOption (lib.mdDoc "Jellyfin Media Server"); </del> <ins> enable = mkEnableOption "Jellyfin Media Server"; package = mkPackageOption pkgs "jellyfin" { }; </ins> user = mkOption { <del> type = types.str; </del> <ins> type = str; </ins> default = "jellyfin"; <del> description = lib.mdDoc "User account under which Jellyfin runs."; </del> <ins> description = "User account under which Jellyfin runs."; </ins> }; <del> package = mkPackageOption pkgs "jellyfin" { }; </del> group = mkOption { <del> type = types.str; </del> <ins> type = str; </ins> default = "jellyfin"; <del> description = lib.mdDoc "Group under which jellyfin runs."; </del> <ins> description = "Group under which jellyfin runs."; }; dataDir = mkOption { type = path; default = "/var/lib/jellyfin"; description = '' Base data directory, passed with `--datadir` see [#data-directory](https://jellyfin.org/docs/general/administration/configuration/#data-directory) ''; }; configDir = mkOption { type = path; default = "${cfg.dataDir}/config"; defaultText = "${cfg.dataDir}/config"; description = '' Directory containing the server configuration files, passed with `--configdir` see [configuration-directory](https://jellyfin.org/docs/general/administration/configuration/#configuration-directory) ''; }; cacheDir = mkOption { type = path; default = "/var/cache/jellyfin"; description = '' Directory containing the jellyfin server cache, passed with `--cachedir` see [#cache-directory](https://jellyfin.org/docs/general/administration/configuration/#cache-directory) ''; }; logDir = mkOption { type = path; default = "${cfg.dataDir}/log"; defaultText = "${cfg.dataDir}/log"; description = '' Directory where the Jellyfin logs will be stored, passed with `--logdir` see [#log-directory](https://jellyfin.org/docs/general/administration/configuration/#log-directory) ''; </ins> }; openFirewall = mkOption { <del> type = types.bool; </del> <ins> type = bool; </ins> default = false; <del> description = lib.mdDoc '' </del> <ins> description = '' </ins> Open the default ports in the firewall for the media server. The HTTP/HTTPS ports can be changed in the Web UI, so this option should <del> only be used if they are unchanged. </del> <ins> only be used if they are unchanged, see [Port Bindings](https://jellyfin.org/docs/general/networking/#port-bindings). </ins> ''; }; }; }; config = mkIf cfg.enable { <del> systemd.services.jellyfin = { description = "Jellyfin Media Server"; after = [ "network-online.target" ]; wants = [ "network-online.target" ]; wantedBy = [ "multi-user.target" ]; # This is mostly follows: https://github.com/jellyfin/jellyfin/blob/master/fedora/jellyfin.service # Upstream also disable some hardenings when running in LXC, we do the same with the isContainer option serviceConfig = rec { Type = "simple"; User = cfg.user; Group = cfg.group; StateDirectory = "jellyfin"; StateDirectoryMode = "0700"; CacheDirectory = "jellyfin"; CacheDirectoryMode = "0700"; UMask = "0077"; WorkingDirectory = "/var/lib/jellyfin"; ExecStart = "${cfg.package}/bin/jellyfin --datadir '/var/lib/${StateDirectory}' --cachedir '/var/cache/${CacheDirectory}'"; Restart = "on-failure"; TimeoutSec = 15; SuccessExitStatus = ["0" "143"]; # Security options: NoNewPrivileges = true; SystemCallArchitectures = "native"; # AF_NETLINK needed because Jellyfin monitors the network connection RestrictAddressFamilies = [ "AF_UNIX" "AF_INET" "AF_INET6" "AF_NETLINK" ]; RestrictNamespaces = !config.boot.isContainer; RestrictRealtime = true; RestrictSUIDSGID = true; ProtectControlGroups = !config.boot.isContainer; ProtectHostname = true; ProtectKernelLogs = !config.boot.isContainer; ProtectKernelModules = !config.boot.isContainer; ProtectKernelTunables = !config.boot.isContainer; LockPersonality = true; PrivateTmp = !config.boot.isContainer; # needed for hardware acceleration PrivateDevices = false; PrivateUsers = true; RemoveIPC = true; SystemCallFilter = [ "~@clock" "~@aio" "~@chown" "~@cpu-emulation" "~@debug" "~@keyring" "~@memlock" "~@module" "~@mount" "~@obsolete" "~@privileged" "~@raw-io" "~@reboot" "~@setuid" "~@swap" ]; SystemCallErrorNumber = "EPERM"; </del> <ins> systemd = { tmpfiles.settings.jellyfinDirs = { "${cfg.dataDir}"."d" = { mode = "700"; inherit (cfg) user group; }; "${cfg.configDir}"."d" = { mode = "700"; inherit (cfg) user group; }; "${cfg.logDir}"."d" = { mode = "700"; inherit (cfg) user group; }; "${cfg.cacheDir}"."d" = { mode = "700"; inherit (cfg) user group; }; }; services.jellyfin = { description = "Jellyfin Media Server"; after = [ "network-online.target" ]; wants = [ "network-online.target" ]; wantedBy = [ "multi-user.target" ]; # This is mostly follows: https://github.com/jellyfin/jellyfin/blob/master/fedora/jellyfin.service # Upstream also disable some hardenings when running in LXC, we do the same with the isContainer option serviceConfig = { Type = "simple"; User = cfg.user; Group = cfg.group; UMask = "0077"; WorkingDirectory = cfg.dataDir; ExecStart = "${getExe cfg.package} --datadir '${cfg.dataDir}' --configdir '${cfg.configDir}' --cachedir '${cfg.cacheDir}' --logdir '${cfg.logDir}'"; Restart = "on-failure"; TimeoutSec = 15; SuccessExitStatus = ["0" "143"]; # Security options: NoNewPrivileges = true; SystemCallArchitectures = "native"; # AF_NETLINK needed because Jellyfin monitors the network connection RestrictAddressFamilies = [ "AF_UNIX" "AF_INET" "AF_INET6" "AF_NETLINK" ]; RestrictNamespaces = !config.boot.isContainer; RestrictRealtime = true; RestrictSUIDSGID = true; ProtectControlGroups = !config.boot.isContainer; ProtectHostname = true; ProtectKernelLogs = !config.boot.isContainer; ProtectKernelModules = !config.boot.isContainer; ProtectKernelTunables = !config.boot.isContainer; LockPersonality = true; PrivateTmp = !config.boot.isContainer; # needed for hardware acceleration PrivateDevices = false; PrivateUsers = true; RemoveIPC = true; SystemCallFilter = [ "~@clock" "~@aio" "~@chown" "~@cpu-emulation" "~@debug" "~@keyring" "~@memlock" "~@module" "~@mount" "~@obsolete" "~@privileged" "~@raw-io" "~@reboot" "~@setuid" "~@swap" ]; SystemCallErrorNumber = "EPERM"; }; </ins> }; }; users.users = mkIf (cfg.user == "jellyfin") { jellyfin = { <del> group = cfg.group; </del> <ins> inherit (cfg) group; </ins> isSystemUser = true; }; };

Discussion:
I currently run Jellyfin in a Docker container but want to deploy it using an ephemeral NixOS container. However, does not expose a option and runs Jellyfin with where . I understand that this directory will be cleared when the container restarts. I'm not familiar with 's nor the aggressive sandboxing. Need I consider something else when adding the option other than user permissions?
I am experimenting with this, I just some options for defining a and a . It seems to "just work tm", but is there anything I should be aware of? I'll run my own nixpkgs branch on my own machine for a little bit before creating a PR, but so far it seems fine.
I looked a bit into this, and I think bind mounts is what works best with systemd. But I didn't really find a lot of info...
Relevant:
I'm interested in this as well. Currently the Sonarr, Radarr, Jackett, and Ombi services provide . Is the approach they use also usable here?