[Unit] Description=Arav's dwelling / Radio / Liquidsoap Requires=icecast.service After=network-online.target icecast.service [Service] Type=simple Restart=on-failure User=dwelling-radio DynamicUser=yes ExecStart=/opt/opam/4.14.0/bin/liquidsoap /etc/dwelling/radio.liq ExecStop=/bin/kill -INT $MAINPID ReadOnlyPaths=/ LogsDirectory=dwelling-radio AmbientCapabilities= CapabilityBoundingSet= LockPersonality=true MemoryDenyWriteExecute=true NoNewPrivileges=true PrivateDevices=true ProtectClock=true ProtectControlGroups=true ProtectHome=true ProtectKernelLogs=true ProtectKernelModules=true ProtectKernelTunables=true ProtectSystem=strict RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX RestrictNamespaces=true RestrictRealtime=true RestrictSUIDSGID=true SystemCallArchitectures=native [Install] WantedBy=multi-user.target