added jellyfin

_template/.env.example

@@ -0,0 +1,28 @@
+# Copy to .env and adjust. .env is git-ignored; this file is not.
+# Never put a real secret in this file.
+
+# ─── Shared settings ────────────────────────────────────────────────
+# compose.yaml already defaults these to 1000/1000/Etc/UTC. Three places
+# can set them, in increasing priority:
+#
+#   1. the defaults in compose.yaml   (a fresh clone just works)
+#   2. this file                       (per-service)
+#   3. exported in your shell          (global, wins over this file)
+#
+# If you keep a global `export PUID=...` in ~/.profile, leave these commented.
+#PUID=1000
+#PGID=1000
+#TZ=Europe/Paris
+
+# ─── Paths ──────────────────────────────────────────────────────────
+# Where persistent data lives. Keep it OUTSIDE the repo so a clone stays
+# clean and a `git status` never shows application state.
+#DATA_PATH=./data
+
+# ─── Ports ──────────────────────────────────────────────────────────
+# Host port for the web UI. Defaulted in compose.yaml.
+#PORT=xxxx
+
+# ─── Required ───────────────────────────────────────────────────────
+# Anything written ${VAR:?...} in compose.yaml belongs here, uncommented,
+# with a note on how to find the right value for this host.

_template/README.md

@@ -0,0 +1,64 @@
+<!--
+DAILY CHECKLIST — copy this directory, then:
+  1. Paste your real compose file into compose.yaml
+  2. Replace host paths with ${DATA_PATH} etc. and list them in .env.example
+  3. Fill "Why it looks like this" — this is the part worth reading
+  4. Add a row to the service table in the root README.md
+  5. Commit: "add <service>"
+Delete this comment when you're done.
+-->
+
+# <Service>
+
+One line: what it is and why you run it.
+
+## Quick start
+
+```bash
+cp .env.example .env
+$EDITOR .env
+docker compose up -d
+```
+
+Then open `http://<host>:<port>`.
+
+## Port
+
+| Port | Protocol | Purpose |
+|------|----------|---------|
+| xxxx | http     | Web UI  |
+
+## Why it looks like this
+
+<!--
+The differentiator. Not "what the options do" — the docs already say that.
+Why *these* choices, on a real machine, after living with it.
+
+Prompts, delete what doesn't apply:
+  - Why this image? (linuxserver vs. official vs. a fork — what made you switch?)
+  - Why these mounts? What actually needs to persist, and what surprised you?
+  - PUID/PGID — what breaks when they're wrong?
+  - Anything here because something failed once? Those are the best notes.
+  - Anything you tried first that didn't work?
+  - Resource limits, hardware access (GPU, /dev/dri), device passthrough
+  - Why this restart policy
+-->
+
+## Gotchas
+
+<!-- Things that cost you time. Empty is fine on day one — add as you hit them. -->
+
+## Exposing it
+
+Publishes a plain HTTP port; nothing here is proxy-aware.
+
+- [Reverse proxy with Caddy](../docs/reverse-proxy.md)
+- [Cloudflare Tunnel](../docs/cloudflare-tunnel.md)
+- [Single sign-on with Authentik](../docs/authentik-sso.md)
+
+<!-- If this service DOES need proxy-specific config (Nextcloud, Gitea), say so here. -->
+
+## Links
+
+- Upstream docs:
+- Image:

_template/compose.yaml

@@ -0,0 +1,27 @@
+# Paste your real compose file here, then adjust:
+#   - drop any `version:` key (obsolete in Compose v2)
+#   - replace hardcoded host paths with ${DATA_PATH}
+#   - remove `volumes:` blocks nothing references
+#   - publish the port; leave TLS and auth to the reverse proxy
+#   - give shared settings a default: ${PUID:-1000}, not ${PUID}
+#   - make host-specific values fail loudly: ${VAR:?how to find it}
+#     (a bare ${VAR} that isn't set becomes an empty string and starts anyway)
+
+services:
+  <service>:
+    image: <image>
+    container_name: <service>
+    restart: unless-stopped
+
+    # Same on every host, so they're defaulted here. A service .env overrides
+    # them, and a global `export PUID=...` in your shell overrides that.
+    environment:
+      - PUID=${PUID:-1000}
+      - PGID=${PGID:-1000}
+      - TZ=${TZ:-Etc/UTC}
+
+    volumes:
+      - ${DATA_PATH:-./data}/config:/config
+
+    ports:
+      - "${PORT:-8080}:8080"