[Unit]
Description=Music Player Daemon ({{ music_daemon }})

[Service]
Type=simple
Restart=on-failure
{% if music_daemon == 'mpd' %}
ExecStart=/usr/bin/mpd --no-daemon
{% elif music_daemon == 'mopidy' %}
ExecStart=/usr/bin/mopidy
{% endif %}
# allow MPD to use real-time priority 40
LimitRTPRIO=40
LimitRTTIME=infinity
# for io_uring
LimitMEMLOCK=64M
# disallow writing to /usr, /bin, /sbin, ...
ProtectSystem=yes
# more paranoid security settings
NoNewPrivileges=yes
ProtectKernelTunables=yes
ProtectControlGroups=yes
# AF_NETLINK is required by libsmbclient, or it will exit() .. *sigh*
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX AF_NETLINK
RestrictNamespaces=yes
