diff --git a/docker_swarm/playbooks/stacks.yml b/docker_swarm/playbooks/stacks.yml
index 4b20139..aee6e5f 100644
--- a/docker_swarm/playbooks/stacks.yml
+++ b/docker_swarm/playbooks/stacks.yml
@@ -16,3 +16,4 @@
     - {role: syncthing, tags: syncthing}
     - {role: kitchenowl, tags: kitchenowl}
     - {role: paperless-ngx, tags: paperless-ngx}
+    - {role: jellyfin, tags: jellyfin}
diff --git a/docker_swarm/roles/cyberchef/docker-stack.yml.j2 b/docker_swarm/roles/cyberchef/docker-stack.yml.j2
index 26b5d18..da01397 100644
--- a/docker_swarm/roles/cyberchef/docker-stack.yml.j2
+++ b/docker_swarm/roles/cyberchef/docker-stack.yml.j2
@@ -11,6 +11,7 @@ services:
     networks:
       - traefik
     deploy:
+      replicas: 3
       labels:
         - traefik.enable=true
         - traefik.http.routers.cyberchef.entrypoints=websecure
diff --git a/docker_swarm/roles/jellyfin/docker-stack.yml.j2 b/docker_swarm/roles/jellyfin/docker-stack.yml.j2
new file mode 100644
index 0000000..793f49f
--- /dev/null
+++ b/docker_swarm/roles/jellyfin/docker-stack.yml.j2
@@ -0,0 +1,56 @@
+# vi: ft=yaml
+version: '3.5'
+
+networks:
+  traefik:
+    external: true
+
+volumes:
+  media:
+    driver_opts:
+      type: "nfs"
+      o: "addr=lewis.dmz,nolock,soft,rw"
+      device: ":/mnt/data/nfs/media"
+  config:
+    driver_opts:
+      type: "nfs"
+      o: "addr=lewis.dmz,nolock,soft,rw"
+      device: ":/mnt/data/nfs/jellyfin/config"
+  cache:
+
+services:
+  jellyfin:
+    image: jellyfin/jellyfin
+    # user: uid:gid
+    network_mode: 'host'
+    volumes:
+      - cache:/cache
+      - type: volume
+        source: config
+        target: /config
+        volume:
+          nocopy: true
+      - type: volume
+        source: media
+        target: /media
+        volume:
+          nocopy: true
+      # - /path/to/media2:/media2:ro
+    # Optional - alternative address used for autodiscovery
+    environment:
+      - JELLYFIN_PublishedServerUrl=http://media.kun.is:444
+    # Optional - may be necessary for docker healthcheck to pass if running in host network mode
+    # extra_hosts:
+    #   - "host.docker.internal:host-gateway"
+    networks:
+      - traefik
+    deploy:
+      labels:
+        - traefik.enable=true
+        - traefik.http.routers.jellyfin.entrypoints=localsecure
+        - traefik.http.routers.jellyfin.rule=Host(`media.kun.is`)
+        - traefik.http.routers.jellyfin.tls=true
+        - traefik.http.routers.jellyfin.tls.certresolver=letsencrypt
+        - traefik.http.routers.jellyfin.service=jellyfin
+        - traefik.http.services.jellyfin.loadbalancer.server.port=8096
+        - traefik.docker.network=traefik
diff --git a/docker_swarm/roles/jellyfin/tasks/main.yml b/docker_swarm/roles/jellyfin/tasks/main.yml
new file mode 100644
index 0000000..255d462
--- /dev/null
+++ b/docker_swarm/roles/jellyfin/tasks/main.yml
@@ -0,0 +1,5 @@
+- name: Deploy Docker stack
+  docker_stack:
+    name: jellyfin
+    compose:
+      - "{{ lookup('template', '{{ role_path }}/docker-stack.yml.j2') | from_yaml }}"
diff --git a/nixos/modules/data-sharing.nix b/nixos/modules/data-sharing.nix
index 280abd5..b19eb0b 100644
--- a/nixos/modules/data-sharing.nix
+++ b/nixos/modules/data-sharing.nix
@@ -1,6 +1,7 @@
 { pkgs, lib, config, ... }:
 let
   cfg = config.lab.data-sharing;
+
   nfsShares = [
     "/nextcloud/data"
     "/radicale"
@@ -15,7 +16,10 @@ let
     "/syncthing/config"
     "/paperless-ngx/data"
     "/paperless-ngx/redisdata"
+    "/media"
+    "/jellyfin/config"
   ];
+
   nfsExports = lib.strings.concatLines (
     builtins.map
       (share: