diff options
Diffstat (limited to 'navidrome.service')
| -rw-r--r-- | navidrome.service | 45 |
1 files changed, 45 insertions, 0 deletions
diff --git a/navidrome.service b/navidrome.service new file mode 100644 index 000000000000..2e38b14d6e01 --- /dev/null +++ b/navidrome.service @@ -0,0 +1,45 @@ +# This file ususaly goes in /etc/systemd/system + +[Unit] +Description=Navidrome Music Server and Streamer compatible with Subsonic/Airsonic +After=remote-fs.target network.target +AssertPathExists=/var/lib/navidrome + +[Service] +User=navidrome +Group=navidrome +Type=simple +ExecStart=/usr/bin/navidrome +WorkingDirectory=/var/lib/navidrome +TimeoutStopSec=20 +KillMode=process +Restart=on-failure + +EnvironmentFile=-/etc/sysconfig/navidrome + +# See https://www.freedesktop.org/software/systemd/man/systemd.exec.html +DevicePolicy=closed +NoNewPrivileges=yes +PrivateTmp=yes +PrivateUsers=yes +ProtectControlGroups=yes +ProtectKernelModules=yes +ProtectKernelTunables=yes +RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 +RestrictNamespaces=yes +RestrictRealtime=yes +SystemCallFilter=~@clock @debug @module @mount @obsolete @privileged @reboot @setuid @swap +ReadWritePaths=/var/lib/navidrome + +# You can uncomment the following line if you're not using the jukebox This +# will prevent navidrome from accessing any real (physical) devices +#PrivateDevices=yes + +# You can change the following line to `strict` instead of `full` if you don't +# want navidrome to be able to write anything on your filesystem outside of +# /var/lib/navidrome. +ProtectSystem=full + +# You can comment the following line if you don't have any media in /home/*. +# This will prevent navidrome from ever reading/writing anything there. +ProtectHome=true |