arr-interconnect: set jellyfin external url for seerr play links

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

services/arr-interconnect.nix

@@ -16,6 +16,11 @@ let
 
     BASE="http://127.0.0.1"
 
+    # Browser-facing Jellyfin URL, handed to Seerr for its "Play on Jellyfin"
+    # links. Must be the nginx vhost, not BASE — remote users can't reach
+    # localhost:8096.
+    JELLYFIN_EXTERNAL_URL="https://jellyfin.nordhammer.it"
+
     # --- Extract API keys ---
     extract_arr_key() {
       if [ -f "$1" ]; then
@@ -581,6 +586,22 @@ RUBY
           fi
         fi
 
+        # --- "Play on Jellyfin" builds its link from jellyfinExternalHost and
+        # --- falls back to the internal ip:port when it's unset, which hands
+        # --- every remote user a localhost:8096 URL. getHostname() ignores
+        # --- this field, so it only affects the browser-facing link, never
+        # --- Seerr's own API calls to Jellyfin.
+        # Checked separately from apiKey above: that block is a first-run gate
+        # and won't fire again once the key is set.
+        if [ "$(seerr_get /settings/jellyfin | jq -r '.externalHostname // empty')" != "$JELLYFIN_EXTERNAL_URL" ]; then
+          echo "Setting Jellyfin external URL in Seerr..."
+          seerr_post /settings/jellyfin "$(jq -n --arg url "$JELLYFIN_EXTERNAL_URL" '{
+            externalHostname: $url
+          }')" > /dev/null && echo "  done" || echo "  failed"
+        else
+          echo "Seerr → Jellyfin external URL already set"
+        fi
+
         # --- Radarr. activeProfileId/activeDirectory are required and have no
         # --- sane default, so pull them from Radarr itself. rootfolder[0] is
         # --- unambiguous because reconcile_root_folders ran first.