[Unit]
Description=Jellyfin Media Server
Wants=network.target
After=network.target

[Container]
Image={{ jellyfin_container_image }}:{{ jellyfin_version }}
#UserNS=keep-id
User=201
Group=201
EnvironmentFile=/etc/sysconfig/jellyfin
Volume=/var/lib/jellyfin:/config:rw,z
Volume=/var/cache/jellyfin:/cache:rw,z
{% for path in jellyfin_media_dirs %}
Volume={{ path }}:/media/{{ path | basename }}:ro
{% endfor %}
Network=host
NoNewPrivileges=yes

[Service]
#MemoryDenyWriteExecute=yes
PrivateTmp=yes
ProtectClock=yes
ProtectHome=yes
ProtectKernelLogs=yes
ProtectKernelModules=yes
ProtectKernelTunables=yes
ProtectProc=invisible
ProtectSystem=strict
ReadWritePaths=/var/lib/jellyfin
ReadWritePaths=/var/lib/containers/storage
ReadWritePaths=/var/cache/jellyfin
RestrictRealtime=yes
RestrictSUIDSGID=yes
SuccessExitStatus=0 143
UMask=0077

[Install]
WantedBy=multi-user.target