diff options
| -rw-r--r-- | debian/jellyfin.service | 3 | ||||
| -rw-r--r-- | fedora/jellyfin.service | 55 |
2 files changed, 47 insertions, 11 deletions
diff --git a/debian/jellyfin.service b/debian/jellyfin.service index ce0a3cf3d..a999b76be 100644 --- a/debian/jellyfin.service +++ b/debian/jellyfin.service @@ -6,6 +6,8 @@ After = network-online.target Type = simple EnvironmentFile = /etc/default/jellyfin User = jellyfin +Group = jellyfin +WorkingDirectory = /var/lib/jellyfin ExecStart = /usr/bin/jellyfin ${JELLYFIN_WEB_OPT} ${JELLYFIN_RESTART_OPT} ${JELLYFIN_FFMPEG_OPT} ${JELLYFIN_SERVICE_OPT} ${JELLYFIN_NOWEBAPP_OPT} ${JELLYFIN_ADDITIONAL_OPTS} Restart = on-failure TimeoutSec = 15 @@ -44,6 +46,5 @@ SystemCallFilter=~@setuid SystemCallFilter=~@swap SystemCallErrorNumber=EPERM - [Install] WantedBy = multi-user.target diff --git a/fedora/jellyfin.service b/fedora/jellyfin.service index f706b0ad3..f2bb2d5f2 100644 --- a/fedora/jellyfin.service +++ b/fedora/jellyfin.service @@ -1,15 +1,50 @@ [Unit] -After=network-online.target -Description=Jellyfin is a free software media system that puts you in control of managing and streaming your media. +Description = Jellyfin Media Server +After = network-online.target [Service] -EnvironmentFile=/etc/sysconfig/jellyfin -WorkingDirectory=/var/lib/jellyfin -ExecStart=/usr/bin/jellyfin ${JELLYFIN_WEB_OPT} ${JELLYFIN_RESTART_OPT} ${JELLYFIN_FFMPEG_OPT} ${JELLYFIN_SERVICE_OPT} ${JELLYFIN_NOWEBAPP_OPT} -TimeoutSec=15 -Restart=on-failure -User=jellyfin -Group=jellyfin +Type = simple +EnvironmentFile = /etc/sysconfig/jellyfin +User = jellyfin +Group = jellyfin +WorkingDirectory = /var/lib/jellyfin +ExecStart = /usr/bin/jellyfin ${JELLYFIN_WEB_OPT} ${JELLYFIN_RESTART_OPT} ${JELLYFIN_FFMPEG_OPT} ${JELLYFIN_SERVICE_OPT} ${JELLYFIN_NOWEBAPP_OPT} ${JELLYFIN_ADDITIONAL_OPTS} +Restart = on-failure +TimeoutSec = 15 + +NoNewPrivileges=true +SystemCallArchitectures=native +RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK +RestrictNamespaces=false +RestrictRealtime=true +RestrictSUIDSGID=true +ProtectClock=true +ProtectControlGroups=false +ProtectHostname=true +ProtectKernelLogs=false +ProtectKernelModules=false +ProtectKernelTunables=false +LockPersonality=true +PrivateTmp=false +PrivateDevices=false +PrivateUsers=true +RemoveIPC=true +SystemCallFilter=~@clock +SystemCallFilter=~@aio +SystemCallFilter=~@chown +SystemCallFilter=~@cpu-emulation +SystemCallFilter=~@debug +SystemCallFilter=~@keyring +SystemCallFilter=~@memlock +SystemCallFilter=~@module +SystemCallFilter=~@mount +SystemCallFilter=~@obsolete +SystemCallFilter=~@privileged +SystemCallFilter=~@raw-io +SystemCallFilter=~@reboot +SystemCallFilter=~@setuid +SystemCallFilter=~@swap +SystemCallErrorNumber=EPERM [Install] -WantedBy=multi-user.target +WantedBy = multi-user.target |