[Unit]
Description=youtube-automate admin server
Documentation=file:///opt/youtube-automate/specs.md
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
# Group=mediaserver and UMask=0002 are load-bearing: Jellyfin reaches the media
# tree only through the mediaserver group, and anything this process writes must
# stay group-readable. See specs.md §2.
User=susan
Group=mediaserver
UMask=0002

WorkingDirectory=/opt/youtube-automate
ExecStart=/var/lib/youtube-automate/venv/bin/youtube-automate serve --host 127.0.0.1 --port 8085

Restart=always
RestartSec=5

NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=full
ProtectControlGroups=true
ProtectKernelTunables=true
RestrictSUIDSGID=true
ReadWritePaths=/var/lib/youtube-automate /disks/Plex/YouTube

[Install]
WantedBy=multi-user.target