[Unit]
Description=VibeSonic - lightweight self-hosted music server
After=network-online.target
Wants=network-online.target
Documentation=https://git.noroutes.net/NoRoutes/vibetunes

[Service]
Type=simple
User=vibesonic
Group=vibesonic
Environment=VIBESONIC_LISTEN_ADDR=:8080
Environment=VIBESONIC_DATA_DIR=/var/lib/vibesonic
Environment=VIBESONIC_DB=/var/lib/vibesonic/vibesonic.db
Environment=VIBESONIC_MUSIC_DIRS=/music
Environment=VIBESONIC_FFMPEG_PATH=/usr/bin/ffmpeg
Environment=VIBESONIC_FFPROBE_PATH=/usr/bin/ffprobe
Environment=VIBESONIC_SCAN_INTERVAL=1h
# Generate a real secret: openssl rand -hex 32
Environment=VIBESONIC_SESSION_SECRET=change-me-to-a-random-string
ExecStart=/usr/local/bin/vibesonic
Restart=on-failure
RestartSec=2s
TimeoutStopSec=30s

NoNewPrivileges=true
ProtectSystem=strict
ProtectHome=true
PrivateTmp=true
PrivateDevices=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectControlGroups=true
RestrictSUIDSGID=true
LockPersonality=true
ReadOnlyPaths=/music
ReadWritePaths=/var/lib/vibesonic

StateDirectory=vibesonic
StateDirectoryMode=0700

LimitNOFILE=65535

[Install]
WantedBy=multi-user.target