[Unit]
Description=Media Server - REST API for controlling system media playback
After=network.target sound.target
Wants=sound.target

# Templated unit. Enable as:
#   sudo systemctl enable --now media-server@$USER
# %i is the user name supplied after the '@'; %U is the matching numeric UID.

[Service]
Type=simple
User=%i
Group=%i

# Working directory (override via drop-in if you install elsewhere)
WorkingDirectory=/opt/media-server

# Start command — adjust to match where you installed the venv. --no-tray
# avoids pulling pystray into a headless service environment.
ExecStart=/opt/media-server/venv/bin/python -m media_server.main --no-tray

Restart=on-failure
RestartSec=10

# Required for MPRIS (dbus.SessionBus) and PulseAudio/PipeWire loopback.
Environment=PYTHONUNBUFFERED=1
Environment=XDG_RUNTIME_DIR=/run/user/%U
Environment=DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/%U/bus

# Light sandboxing. ProtectHome=read-only by itself blocks the app's own
# audit.log / thumbnail cache writes — ReadWritePaths re-opens just the
# two state dirs the server owns.
NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=strict
ProtectHome=read-only
ReadWritePaths=/home/%i/.config/media-server /home/%i/.cache/media-server

[Install]
WantedBy=multi-user.target