From ff26051c8ada91bf290a8e058ef3b3ef290c5172 Mon Sep 17 00:00:00 2001
From: carlitosbond <carlitosbond@gmail.com>
Date: Wed, 26 Aug 2026 01:56:02 +0000
Subject: [PATCH] Add stream.carloselugo.com Caddy block for Jellyfin

Reverse-proxies to the jellyfin container over web_web-net, with
buffering disabled for WebSocket/streaming and X-Frame-Options set
to SAMEORIGIN instead of the default DENY.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 Caddyfile | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/Caddyfile b/Caddyfile
index 626eb2c..d7b357c 100644
--- a/Caddyfile
+++ b/Caddyfile
@@ -202,3 +202,22 @@ fotos.carloselugo.com {
         format json
     }
 }
+
+# ── Jellyfin — stream.carloselugo.com ──────────────────────────────────────────
+stream.carloselugo.com {
+    header {
+        Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
+        X-Content-Type-Options "nosniff"
+        X-Frame-Options "SAMEORIGIN"
+        Referrer-Policy "strict-origin-when-cross-origin"
+        -Server
+    }
+    reverse_proxy jellyfin:8096 {
+        flush_interval -1
+    }
+    encode gzip
+    log {
+        output file /var/log/caddy/jellyfin.log
+        format json
+    }
+}