blob: 5f2ebda4fe57667b2a8e87273deb8187f0613ff2 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
|
[Unit]
Description=Polaris: music streaming application
After=syslog.target
After=network.target
[Service]
User=polaris
Group=polaris
Type=simple
WorkingDirectory=~
Environment=USER=polaris HOME=/var/lib/polaris
ExecStart=/usr/bin/polaris -f -c /etc/polaris/config.toml
# Additional security-related features
PrivateTmp=true
ProtectHome=read-only
ProtectControlGroups=true
ProtectKernelModules=true
ProtectKernelTunables=true
RestrictAddressFamilies=AF_INET AF_INET6
RestrictNamespaces=true
RestrictRealtime=true
SystemCallArchitectures=native
[Install]
WantedBy=multi-user.target
|