Add Jellyfin media stack (LXC 106, NVIDIA GTX 1060)

- New Ansible role: jellyfin — Docker + nvidia-container-toolkit setup,
  full *arr stack compose file (Jellyfin, qBittorrent, Radarr, Sonarr,
  Prowlarr, FlareSolverr, Jellyseerr), systemd service for auto-start
- New playbook: jellyfin.yml targeting media_servers group
- Inventory: add media LXC (10.10.1.50) to media_servers group
- Traefik: add internal .homelab routes for all 6 media services
- Pi-hole: add DNS records for all 6 media services → Traefik
- network-interfaces: DNAT port 6881 TCP+UDP → 10.10.1.50 for BitTorrent
- homelab-requirements.md: document full Jellyfin stack requirements
  including NVIDIA GTX 1060 passthrough approach and driver notes
- jellyfin-tools: original reference compose file from upstream

Infrastructure created on Proxmox:
- LXC 106 (media, Debian 12, privileged, nesting=1, 10.10.1.50/vmbr1)
- ZFS dataset hdd/media mounted at /media in LXC
- NVIDIA device passthrough entries in /etc/pve/lxc/106.conf

Note: NVIDIA driver 580.159.03 (.run) installed on Proxmox host — not
managed by apt (Debian only has 550.x which doesn't support kernel 7.x
or GTX 1060 Pascal as of this driver version).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

ansible/roles/traefik/defaults/main.yml

@@ -25,3 +25,25 @@ traefik_services:
   - name: pihole
     host: "pihole.homelab"
     backend: "http://10.10.1.2:80"
+  - name: jellyfin
+    host: "jellyfin.homelab"
+    backend: "http://10.10.1.50:8096"
+  - name: jellyseerr
+    host: "jellyseerr.homelab"
+    backend: "http://10.10.1.50:5055"
+  - name: radarr
+    host: "radarr.homelab"
+    backend: "http://10.10.1.50:7878"
+  - name: sonarr
+    host: "sonarr.homelab"
+    backend: "http://10.10.1.50:8989"
+  - name: prowlarr
+    host: "prowlarr.homelab"
+    backend: "http://10.10.1.50:9696"
+  - name: qbittorrent
+    host: "qbittorrent.homelab"
+    backend: "http://10.10.1.50:5080"
+  - name: proxmox
+    host: "proxmox.homelab"
+    backend: "https://192.168.1.10:8006"
+    tls_skip_verify: true

ansible/roles/traefik/templates/routes.yml.j2

@@ -6,6 +6,8 @@ http:
       service: {{ svc.name }}
       entryPoints:
         - web
+        - websecure
+      tls: {}
 {% if svc.public_host is defined %}
     {{ svc.name }}-public-redirect:
       rule: "Host(`{{ svc.public_host }}`){% if svc.public_path is defined %} && PathPrefix(`{{ svc.public_path }}`){% endif %}"
@@ -48,4 +50,23 @@ http:
       loadBalancer:
         servers:
           - url: "{{ svc.backend }}"
+{% if svc.tls_skip_verify is defined and svc.tls_skip_verify %}
+        serversTransport: {{ svc.name }}-transport
+{% endif %}
 {% endfor %}
+
+{% set ns = namespace(has_skip_verify=false) %}
+{% for svc in traefik_services %}
+{% if svc.tls_skip_verify is defined and svc.tls_skip_verify %}
+{% set ns.has_skip_verify = true %}
+{% endif %}
+{% endfor %}
+{% if ns.has_skip_verify %}
+  serversTransports:
+{% for svc in traefik_services %}
+{% if svc.tls_skip_verify is defined and svc.tls_skip_verify %}
+    {{ svc.name }}-transport:
+      insecureSkipVerify: true
+{% endif %}
+{% endfor %}
+{% endif %}