[Unit]
Description=ytstream admin server
Documentation=file:///opt/ytstream/plan.md
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
# See plan.md §9 — the same ownership rules as the proxy, because subscribing a
# channel through the UI writes into the media tree.
User=susan
Group=mediaserver
UMask=0002

Environment=PATH=/var/lib/ytstream/venv/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
Environment=PYTHONUNBUFFERED=1

WorkingDirectory=/opt/ytstream
# Port 8086: youtube-automate holds 8085 for as long as the two run side by side.
ExecStart=/var/lib/ytstream/venv/bin/ytstream serve --host 127.0.0.1 --port 8086

Restart=always
RestartSec=5

NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=full
ProtectControlGroups=true
ProtectKernelTunables=true
RestrictSUIDSGID=true
ReadWritePaths=/var/lib/ytstream /disks/Plex/_ytstream

[Install]
WantedBy=multi-user.target