{
	containers.jellyfin = {
		autoStart = true;
		privateNetwork = true;
		hostBridge = "br-lan0";
		localMacAddress = "02:00:00:00:00:02";
		bindMounts = {
			"/media" = {
				hostPath = "/media/ingens/media";
				isReadOnly = true;
			};
		};

		# GPU
		allowedDevices = [
			{ node = "/dev/nvidia0";           modifier = "rw"; }
			{ node = "/dev/nvidiactl";         modifier = "rw"; }
			{ node = "/dev/nvidia-uvm";        modifier = "rw"; }
			{ node = "/dev/nvidia-uvm-tools";  modifier = "rw"; }
			{ node = "/dev/nvidia-modeset";    modifier = "rw"; }
		];

		bindMounts = {
			# NVENC/NVDEC - video transcoding
			"/dev/nvidia0"           = { hostPath = "/dev/nvidia0";           isReadOnly = false; };
			"/dev/nvidiactl"         = { hostPath = "/dev/nvidiactl";         isReadOnly = false; };
			# CUDA - required for ML inference
			"/dev/nvidia-uvm"        = { hostPath = "/dev/nvidia-uvm";        isReadOnly = false; };
			"/dev/nvidia-uvm-tools"  = { hostPath = "/dev/nvidia-uvm-tools";  isReadOnly = false; };
			# Modeset - needed by some driver paths
			"/dev/nvidia-modeset"    = { hostPath = "/dev/nvidia-modeset";    isReadOnly = false; };
		};

		config = { lib, config, pkgs, ... }: {
			imports = [ ./nvidia.nix ];

			# Network
			networking.interfaces.eth0.useDHCP = true;
			networking.firewall.allowedTCPPorts = [ 80 ];  # Caddy

			# Jellyfin
			services.jellyfin = {
				enable = true;
				openFirewall = true;

				hardwareAcceleration = {
					enable = true;
					type = "nvenc";
					device = "/dev/nvidia0"; # Required by the module's assertion, unused in encoding.xml for nvenc
				};

				forceEncodingConfig = true;  # Override encoding.xml

				transcoding = {
					enableHardwareEncoding = true;

					hardwareEncodingCodecs = {
						hevc = true;  # Pascal 4th-gen NVENC supports HEVC 8/10-bit encode
						av1  = false;  # NOT supported on Pascal — do not enable
					};

					hardwareDecodingCodecs = {
						h264 = true;
						hevc = true;
						hevc10bit = true;
						vp8 = true;
						vp9 = true;
						mpeg2 = true;
						vc1 = true;
						av1 = false;  # NOT supported on Pascal NVDEC
						hevcRExt10bit = false;  # Range Extensions decode is a newer-gen feature, skip on Pascal
						hevcRExt12bit = false;
					};

					encodingPreset = "medium";
					enableToneMapping = true; # works via CUDA-based tonemap_cuda filter on Pascal+
				};
			};

			# Reverse proxy
			services.caddy = {
				enable = true;
				virtualHosts.":80".extraConfig = ''
					reverse_proxy localhost:8096
				'';
			};

			system.stateVersion = "26.05";
		};
	};
}