[Unit]
Description=Navidrome Music Server
Documentation=https://www.navidrome.org/docs/
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
User={{ navidrome_user }}
Group={{ navidrome_group }}
WorkingDirectory={{ navidrome_data_dir }}
ExecStart={{ navidrome_bin_path }} --configfile {{ navidrome_config_file }}
Restart=always
RestartSec=20
TimeoutStopSec=60
StandardOutput=journal
StandardError=journal

# Hardening: Navidrome writes its database and cache, and nothing else.
NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=strict
ProtectHome=read-only
# {{ navidrome_music_dir }} is deliberately absent: ProtectSystem=strict leaves
# it read-only, which is exactly right. Navidrome indexes the library; beets
# writes it. If Navidrome ever appears to need write access here, something is
# wrong with the request, not with this line.
ReadWritePaths={{ navidrome_data_dir }}

LimitNOFILE=65535

[Install]
WantedBy=multi-user.target