Fix Jellyfin fetch failing due to private CA certificate

The pod couldn't verify tv.will.net's TLS cert (signed by Homelab CA,
not in Node's default bundle). All server-side Jellyfin calls now use
internalFetch which disables certificate verification via undici Agent.

Also improves error messages by extracting e.cause details (ECONNREFUSED,
ENOTFOUND) instead of passing through the opaque "fetch failed" string.

Author: willuhmjs

src/lib/server/services/cleanup.service.ts

@@ -5,6 +5,7 @@ import { setTimeout as delay } from 'timers/promises';
 import { basename } from 'path';
 import { libraryService } from './library.service';
 import { sseEmitter } from '../sse/emitter';
+import { internalFetch } from '../utils/fetch';
 
 class CleanupService {
 	private running = false;
@@ -115,7 +116,7 @@ class CleanupService {
 		filepath: string,
 	): Promise<string | null> {
 		const searchTerm = filename.replace(/\.[^.]+$/, '');
-		const res = await fetch(
+		const res = await internalFetch(
 			`${baseUrl}/Items?searchTerm=${encodeURIComponent(searchTerm)}&Recursive=true&Fields=Path&Limit=25`,
 			{
 				headers: { 'X-Emby-Token': apiKey },
@@ -144,7 +145,7 @@ class CleanupService {
 		userIds: string[],
 	): Promise<boolean> {
 		for (const userId of userIds) {
-			const res = await fetch(
+			const res = await internalFetch(
 				`${baseUrl}/Users/${userId}/Items/${itemId}/UserData`,
 				{
 					headers: { 'X-Emby-Token': apiKey },
@@ -177,7 +178,7 @@ class CleanupService {
 		}
 
 		try {
-			const res = await fetch(`${baseUrl}/Items/${jellyfinItemId}`, {
+			const res = await internalFetch(`${baseUrl}/Items/${jellyfinItemId}`, {
 				method: 'DELETE',
 				headers: { 'X-Emby-Token': apiKey },
 				signal: AbortSignal.timeout(10000),

src/lib/server/services/library.service.ts

@@ -7,6 +7,7 @@ import { musicMetadataService } from './music-metadata.service';
 import { ytdlpService } from './ytdlp.service';
 import { plexService } from './plex.service';
 import { effectiveCacheQuota } from '../permissions';
+import { internalFetch } from '../utils/fetch';
 
 function sanitizeFilename(name: string): string {
 	return name.replace(/[<>:"/\\|?*\x00-\x1f]/g, '_').trim() || 'Unknown';
@@ -585,7 +586,7 @@ class LibraryService {
 		if (settings.jellyfinUrl && settings.jellyfinApiKey) {
 			try {
 				const url = `${settings.jellyfinUrl.replace(/\/$/, '')}/Library/Refresh`;
-				await fetch(url, {
+				await internalFetch(url, {
 					method: 'POST',
 					headers: {
 						'X-Emby-Token': settings.jellyfinApiKey,

src/lib/server/utils/fetch.ts

@@ -0,0 +1,11 @@
+import { Agent } from 'undici';
+
+const insecureAgent = new Agent({ connect: { rejectUnauthorized: false } });
+
+/**
+ * fetch() variant for internal/homelab services that may use self-signed or
+ * private-CA certificates not trusted by Node's default CA bundle.
+ */
+export function internalFetch(url: string | URL, init?: RequestInit): Promise<Response> {
+	return fetch(url, { ...init, dispatcher: insecureAgent } as RequestInit & { dispatcher: unknown });
+}

src/routes/api/settings/jellyfin-test/+server.ts

@@ -1,5 +1,6 @@
 import { json, error } from '@sveltejs/kit';
 import { apiRoute } from '$lib/server/openapi';
+import { internalFetch } from '$lib/server/utils/fetch';
 import type { RequestHandler } from './$types';
 
 export const POST = apiRoute('/api/settings/jellyfin-test', 'POST', {
@@ -36,7 +37,7 @@ export const POST = apiRoute('/api/settings/jellyfin-test', 'POST', {
 
 	try {
 		const baseUrl = url.replace(/\/$/, '');
-		const res = await fetch(`${baseUrl}/System/Info`, {
+		const res = await internalFetch(`${baseUrl}/System/Info`, {
 			headers: { 'X-Emby-Token': apiKey },
 			signal: AbortSignal.timeout(10000),
 		});
@@ -48,7 +49,21 @@ export const POST = apiRoute('/api/settings/jellyfin-test', 'POST', {
 		const info = await res.json();
 		return json({ success: true, serverName: info.ServerName || 'Jellyfin' });
 	} catch (e: any) {
-		const message = e.name === 'TimeoutError' ? 'Connection timed out' : (e.message || 'Connection failed');
+		let message: string;
+		if (e.name === 'TimeoutError') {
+			message = 'Connection timed out';
+		} else if (e.cause) {
+			const cause = e.cause as any;
+			if (cause.code === 'ECONNREFUSED') {
+				message = 'Connection refused — is Jellyfin running?';
+			} else if (cause.code === 'ENOTFOUND') {
+				message = `Could not resolve host — check the server URL`;
+			} else {
+				message = cause.message || 'Connection failed';
+			}
+		} else {
+			message = e.message || 'Connection failed';
+		}
 		return json({ success: false, error: message });
 	}
 }) satisfies RequestHandler;

src/routes/api/settings/jellyfin-users/+server.ts

@@ -1,6 +1,7 @@
 import { json, error } from '@sveltejs/kit';
 import { prisma } from '$lib/server/db';
 import { apiRoute } from '$lib/server/openapi';
+import { internalFetch } from '$lib/server/utils/fetch';
 import type { RequestHandler } from './$types';
 
 export const GET = apiRoute('/api/settings/jellyfin-users', 'GET', {
@@ -38,7 +39,7 @@ export const GET = apiRoute('/api/settings/jellyfin-users', 'GET', {
 
 	try {
 		const baseUrl = settings.jellyfinUrl.replace(/\/$/, '');
-		const res = await fetch(`${baseUrl}/Users`, {
+		const res = await internalFetch(`${baseUrl}/Users`, {
 			headers: { 'X-Emby-Token': settings.jellyfinApiKey },
 			signal: AbortSignal.timeout(10000),
 		});
@@ -53,7 +54,21 @@ export const GET = apiRoute('/api/settings/jellyfin-users', 'GET', {
 		);
 	} catch (e: any) {
 		if (e.status) throw e;
-		const message = e.name === 'TimeoutError' ? 'Connection timed out' : (e.message || 'Failed to fetch users');
+		let message: string;
+		if (e.name === 'TimeoutError') {
+			message = 'Connection timed out';
+		} else if (e.cause) {
+			const cause = e.cause as any;
+			if (cause.code === 'ECONNREFUSED') {
+				message = 'Connection refused — is Jellyfin running?';
+			} else if (cause.code === 'ENOTFOUND') {
+				message = `Could not resolve host — check the server URL`;
+			} else {
+				message = cause.message || 'Failed to connect to Jellyfin';
+			}
+		} else {
+			message = e.message || 'Failed to fetch users';
+		}
 		throw error(502, message);
 	}
 }) satisfies RequestHandler;