Harden systemd service, update restart policy (#888)

librespot-org · Nov 26, 2021 · bbd575e · bbd575e
1 parent 97399e2
commit bbd575e
Show file tree

Hide file tree

Showing 3 changed files with 7 additions and 4 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -11,6 +11,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - [main] Enforce reasonable ranges for option values (breaking).
 - [main] Don't evaluate options that would otherwise have no effect.
 - [playback] `alsa`: Improve `--device ?` functionality for the alsa backend.
+- [contrib] Hardened security of the systemd service units
 
 ### Added
 - [cache] Add `disable-credential-cache` flag (breaking).

diff --git a/contrib/librespot.service b/contrib/librespot.service
@@ -2,12 +2,12 @@
 Description=Librespot (an open source Spotify client)
 Documentation=https://github.com/librespot-org/librespot
 Documentation=https://github.com/librespot-org/librespot/wiki/Options
-Requires=network-online.target
-After=network-online.target
+Wants=network.target sound.target
+After=network.target sound.target
 
 [Service]
-User=nobody
-Group=audio
+DynamicUser=yes
+SupplementaryGroups=audio
 Restart=always
 RestartSec=10
 ExecStart=/usr/bin/librespot --name "%p@%H"

diff --git a/contrib/librespot.user.service b/contrib/librespot.user.service
@@ -2,6 +2,8 @@
 Description=Librespot (an open source Spotify client)
 Documentation=https://github.com/librespot-org/librespot
 Documentation=https://github.com/librespot-org/librespot/wiki/Options
+Wants=network.target sound.target
+After=network.target sound.target
 
 [Service]
 Restart=always