A high-performance Jellyfin server starts with a smart storage layout. The goal is to separate the application's working data from your media files. Jellyfin constantly reads and writes small files like artwork, metadata, and user watch history. Placing this data on a fast drive, like an SSD, dramatically speeds up the user interface and makes browsing your library feel instant.

Your media files, on the other hand, are large and read sequentially during playback. They are perfectly happy on slower, high-capacity hard drives. This separation keeps the system organized and efficient.

On TrueNAS SCALE, the standard practice is to create a dedicated dataset for all your applications. Let's call it apps. This dataset should live on a pool comprised of SSDs if possible. Within your main media dataset (e.g., tank/media), you will have sub-folders for movies, tvshows, etc. The apps dataset should exist alongside this, not inside it (e.g., ssd-pool/apps). This structure isolates application data from your valuable media library.

Running applications as the root user is a major security risk. If a vulnerability were discovered in Jellyfin, an attacker could gain control over your entire TrueNAS system. To prevent this, we'll follow the principle of least privilege by creating a dedicated, unprivileged user for our applications.

TrueNAS SCALE simplifies this by providing a built-in user named apps specifically for this purpose. This user has the User ID 568. While you could create your own jellyfin user, it's best practice to use the standard apps user, as it ensures compatibility with how TrueNAS manages applications. You don't need to create this user; it already exists. Our next task is to grant this specific user permission to read your media files.

Now we need to connect the apps user to your media. We do this using an Access Control List (ACL), which offers fine-grained control over file permissions. This is the most common point of failure when setting up Jellyfin, often resulting in an empty library because the server can't see the files.

Navigate to your main media dataset (e.g., tank/media), not the individual movies or tvshows folders. You'll want to edit its ACL. Here's the process:

1. Select the Dataset: Go to the Storage > Datasets section and find your parent media dataset.
2. Edit ACL: Click the three dots and choose 'Edit Permissions'.
3. Add an Item: Click 'Add Item'. For 'Who', select 'User'. In the 'User' field that appears, type apps.
4. Set Permissions: For 'Permissions', choose 'Read'. This allows Jellyfin to scan files and read metadata, but not modify or delete anything. 'Full Control' is an option if you want Jellyfin to manage .nfo files or delete media from its interface, but 'Read' is safer and sufficient for most.
5. Apply Recursively: This is the most critical step. Check the box for 'Apply permissions recursively'. This ensures the permissions are pushed down to every single file and folder within your media dataset. If you skip this, Jellyfin will only see the top-level folder, not the media inside.

By following these steps, you've created a secure and efficient foundation for Jellyfin. The application's data is isolated on fast storage, it runs as an unprivileged user, and it has exactly the permissions it needs to access your media—nothing more.