diff --git a/main.yml b/main.yml
index fb25c64..955fd60 100644
--- a/main.yml
+++ b/main.yml
@@ -13,3 +13,10 @@
   roles:
     - samba
   tags: samba
+
+- name: Set up Jellyfin
+  hosts: all
+  become: yes
+  roles:
+    - jellyfin
+  tags: jellyfin
diff --git a/roles/jellyfin/files/jellyfin-defaults b/roles/jellyfin/files/jellyfin-defaults
new file mode 100644
index 0000000..f8ffd62
--- /dev/null
+++ b/roles/jellyfin/files/jellyfin-defaults
@@ -0,0 +1,53 @@
+# Jellyfin default configuration options
+# This is a POSIX shell fragment
+
+# Use this file to override the default configurations; add additional
+# options with JELLYFIN_ADD_OPTS.
+
+# Under systemd, use
+#  /etc/systemd/system/jellyfin.service.d/jellyfin.service.conf
+# to override the user or this config file's location.
+
+#
+# General options
+#
+
+# Program directories
+JELLYFIN_DATA_DIR="/mnt/data1/jellyfin/data"
+JELLYFIN_CONFIG_DIR="/mnt/data1/jellyfin/config"
+JELLYFIN_LOG_DIR="/mnt/data1/jellyfin/log"
+JELLYFIN_CACHE_DIR="/mnt/data1/jellyfin/cache"
+
+# web client path, installed by the jellyfin-web package
+JELLYFIN_WEB_OPT="--webdir=/usr/share/jellyfin/web"
+
+# Restart script for in-app server control
+JELLYFIN_RESTART_OPT="--restartpath=/usr/lib/jellyfin/restart.sh"
+
+# ffmpeg binary paths, overriding the system values
+JELLYFIN_FFMPEG_OPT="--ffmpeg=/usr/lib/jellyfin-ffmpeg/ffmpeg"
+
+# [OPTIONAL] run Jellyfin as a headless service
+#JELLYFIN_SERVICE_OPT="--service"
+
+# [OPTIONAL] run Jellyfin without the web app
+#JELLYFIN_NOWEBAPP_OPT="--nowebclient"
+
+# Space to add additional command line options to jellyfin (for help see ~$ jellyfin --help)
+JELLYFIN_ADDITIONAL_OPTS=""
+
+# [OPTIONAL] run Jellyfin with ASP.NET Server Garbage Collection (uses more RAM and less CPU than Workstation GC)
+# 0 = Workstation
+# 1 = Server
+#COMPlus_gcServer=1
+
+#
+# SysV init/Upstart options
+#
+# Note: These options are ignored by systemd; use /etc/systemd/system/jellyfin.d overrides instead.
+#
+
+# Application username
+JELLYFIN_USER="jellyfin"
+# Full application command
+JELLYFIN_ARGS="$JELLYFIN_WEB_OPT $JELLYFIN_RESTART_OPT $JELLYFIN_FFMPEG_OPT $JELLYFIN_SERVICE_OPT $JELLYFIN_NOWEBAPP_OPT $JELLFIN_ADDITIONAL_OPTS"
diff --git a/roles/jellyfin/handlers/main.yml b/roles/jellyfin/handlers/main.yml
new file mode 100644
index 0000000..048ea0c
--- /dev/null
+++ b/roles/jellyfin/handlers/main.yml
@@ -0,0 +1,5 @@
+---
+- name: restart-jellyfin
+  service:
+    name: jellyfin
+    state: restarted
diff --git a/roles/jellyfin/tasks/main.yml b/roles/jellyfin/tasks/main.yml
index e02fb3f..0b1cc73 100644
--- a/roles/jellyfin/tasks/main.yml
+++ b/roles/jellyfin/tasks/main.yml
@@ -13,3 +13,19 @@
   apt:
     name: jellyfin
     state: present
+
+- name: Copy over Environment file
+  copy:
+    src: jellyfin-defaults
+    dest: '/etc/default/jellyfin'
+    owner: root
+    group: root
+    mode: '644'
+  notify: restart-jellyfin
+
+- name: Ensure Jellyfin service is running & enabled
+  service:
+    name: jellyfin
+    state: started
+    enabled: true
+
diff --git a/roles/samba/tasks/main.yml b/roles/samba/tasks/main.yml
index bba8e28..b46817e 100644
--- a/roles/samba/tasks/main.yml
+++ b/roles/samba/tasks/main.yml
@@ -19,6 +19,8 @@
     password: "{{ lambroek_password }}"
     shell: /sbin/nologin
 
+# TODO run "smbpasswd -a lambroek"
+
 - name: Copy over smb config file
   copy:
     src: smb.conf