Fix filesystem mounts and add tunnel config

hosts/library/default.nix

@@ -34,41 +34,49 @@ with lib.my;
     ];
     wants = [ "network-online.target" ];
     serviceConfig = {
-      Type=Simple;
-      ExecStart='''
-        ssh \
-          -NT
+      Type="simple";
+      ExecStart=pkgs.lib.mkForce ''
+        ${pkgs.openssh}/bin/ssh \
+          -NT \
           -o ExitOnForwardFailure=yes \
           -o ServerAliveInterval=60 \
           -o TCPKeepAlive=no \
           -i %h/.ssh/id_jellyfin \
           -R localhost:8096:localhost:8096 \
           jellyfin@vps1.mesh.vimium.net
-      ''';
-      Restart=on-failure;
+      '';
+      Restart="on-failure";
     };
     wantedBy = [ "default.target" ];
   };
 
-  virtualisation.podman.enable = true;
+  virtualisation.podman = {
+    enable = true;
+    extraPackages = [ pkgs.zfs ];
+  };
+  virtualisation.containers.storage.settings = {
+    storage = {
+      driver = "zfs";
+      graphroot = "/var/lib/containers/storage";
+      runroot = "/run/containers/storage";
+    };
+  };
   virtualisation.oci-containers.containers = {
     jellyfin = {
-      user = "1000:1000";
       image = "docker.io/jellyfin/jellyfin:10.8.10";
       autoStart = true;
-      ports = "8096:8096/tcp";
+      ports = [ "8096:8096/tcp" ];
       volumes = [
         "jellyfin-cache:/cache:Z"
         "jellyfin-config:/config:Z"
       ];
       extraOptions = [
         "--detach"
-        "--label io.containers.autoupdate=registry"
         "--privileged"
-        "--userns keep-id"
+	"--label=io.containers.autoupdate=registry"
         "--group-add=989"
-        "--mount type=bind,source=/mnt/library,target=/library"
-        "--device /dev/dri:/dev/dri"
+        "--mount=type=bind,source=/mnt/library,target=/library,ro=true"
+        "--device=/dev/dri:/dev/dri"
       ];
     };
   };