From 50dedefe791655d04464d13927775f0ed2dfa211 Mon Sep 17 00:00:00 2001
From: Jakob Lechner <mail@jalr.de>
Date: Mon, 6 Oct 2025 16:53:34 +0200
Subject: [PATCH] Add ro bind mounts for CA certificates

---
 hosts/iron/services/jellyfin.nix | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/hosts/iron/services/jellyfin.nix b/hosts/iron/services/jellyfin.nix
index f5d642f..0842575 100644
--- a/hosts/iron/services/jellyfin.nix
+++ b/hosts/iron/services/jellyfin.nix
@@ -14,9 +14,12 @@ in
         "/var/lib/jellyfin"
       ];
       BindReadOnlyPaths = [
-        "/nix/store"
+        "/etc/resolv.conf"
+        "/etc/ssl"
+        "/etc/static/ssl"
         "/filebitch/pub/Filme"
         "/filebitch/pub/Serien"
+        "/nix/store"
         "/var/lib/qBittorrent/downloads"
       ];
       CapabilityBoundingSet = "";