systemd definition for pulseaudio in system-mode (example for archlinux). The pulseaudio developers explicitly recommend to NOT run pulseaudo system-mode!

pulseaudio.service

# systemd service spec for pulseaudio running in system mode -- not recommended though!
# on arch, put it under /etc/systemd/system/pulseaudio.service
# start with: systemctl start pulseaudio.service
# enable on boot: systemctl enable pulseaudio.service 
[Unit]
Description=Pulseaudio sound server
After=avahi-daemon.service network.target

[Service]
ExecStart=/usr/bin/pulseaudio --system --disallow-exit --disallow-module-loading
ExecReload=/bin/kill -HUP $MAINPID

[Install]
WantedBy=multi-user.target

You should add --daemonize=no.

I use pulseaudio over a network and I need to wait for the interface to be up. I can't seem to be able to do it with systemd so instead I restart the pulseaudio service when it fails to start at boot

    [Service]
    Restart=always
    RestartSec=30

Thanks a million. This is exactly what I was looking for. The pulseaudio stopped working on our system after the introduction of systemd, and I needed the place where I can include the flag --system in systemd for pulseaudio.

Pulseadio configured correctly forks and drops root privileges, and runs under the user pulse.
If the service is not adapted, pulseaudio simply exits.

Type=forking
ExecStart=/usr/bin/pulseaudio --realtime --no-cpu-limit --system --disallow-exit --daemon

https://gist.github.com/bxabi/5295beadbfce8f4e697733e7244c4402#file-pulseaudio-service-L10

I can't get it working on my intel-nuc running CentOs 8.
strange thing is that I don't have a problem when running the command directly from the command line as user root.

[root@nuc-jan system]# systemctl start pulseaudio
[root@nuc-jan system]# systemctl status pulseaudio
  pulseaudio.service - Pulseaudio sound server
   Loaded: loaded (/etc/systemd/system/pulseaudio.service; disabled; vendor preset: disabled)
   Active: failed (Result: exit-code) since Sat 2020-12-12 09:53:25 CET; 9s ago
  Process: 2323785 ExecStart=/usr/bin/pulseaudio -vvvv --system --disallow-exit --disallow-module-loading (code=exited, status=1/FAILURE)
 Main PID: 2323785 (code=exited, status=1/FAILURE)

Dec 12 09:53:25 nuc-jan.borsbeek systemd[1]: Started Pulseaudio sound server.
Dec 12 09:53:25 nuc-jan.borsbeek pulseaudio[2323785]: N: [pulseaudio] main.c: Running in system mode, forcibly disabling SHM mode.
Dec 12 09:53:25 nuc-jan.borsbeek pulseaudio[2323785]: N: [pulseaudio] main.c: Running in system mode, forcibly disabling exit idle time.
Dec 12 09:53:25 nuc-jan.borsbeek pulseaudio[2323785]: D: [pulseaudio] core-rtclock.c: Timer slack is set to 50 us.
Dec 12 09:53:25 nuc-jan.borsbeek pulseaudio[2323785]: D: [pulseaudio] core-util.c: setpriority() worked.
Dec 12 09:53:25 nuc-jan.borsbeek pulseaudio[2323785]: I: [pulseaudio] core-util.c: Successfully gained nice level -11.
Dec 12 09:53:25 nuc-jan.borsbeek pulseaudio[2323785]: I: [pulseaudio] main.c: Found user 'pulse' (UID 171) and group 'pulse' (GID 171).
Dec 12 09:53:25 nuc-jan.borsbeek pulseaudio[2323785]: E: [pulseaudio] main.c: Failed to create '/var/lib/pulse': Permission denied
Dec 12 09:53:25 nuc-jan.borsbeek systemd[1]: pulseaudio.service: Main process exited, code=exited, status=1/FAILURE
Dec 12 09:53:25 nuc-jan.borsbeek systemd[1]: pulseaudio.service: Failed with result 'exit-code'.
[root@nuc-jan system]#

Root cause (?):
pulseaudio executed with option --system will change its user from root to pulse : this change is failing when starting pulseaudio as systemd service (it works when starting from command line).

FYI this is what is written by pulseaudio in the log file when started by systemctl start pulseaudio:

N: [pulseaudio] main.c: Running in system mode, forcibly disabling SHM mode.
N: [pulseaudio] main.c: Running in system mode, forcibly disabling exit idle time.
D: [pulseaudio] core-rtclock.c: Timer slack is set to 50 us.
D: [pulseaudio] core-util.c: setpriority() worked.
I: [pulseaudio] core-util.c: Successfully gained nice level -11.
I: [pulseaudio] main.c: Found user 'pulse' (UID 171) and group 'pulse' (GID 171).
E: [pulseaudio] main.c: Failed to create '/var/lib/pulse': Permission denied

This is what is logged by pulseaudio when starting from command line as user root:

N: [pulseaudio] main.c: Running in system mode, forcibly disabling SHM mode.
N: [pulseaudio] main.c: Running in system mode, forcibly disabling exit idle time.
D: [pulseaudio] core-rtclock.c: Timer slack is set to 50 us.
D: [pulseaudio] core-util.c: setpriority() worked.
I: [pulseaudio] core-util.c: Successfully gained nice level -11.
I: [pulseaudio] main.c: Found user 'pulse' (UID 171) and group 'pulse' (GID 171).
I: [pulseaudio] main.c: Successfully changed user to "pulse".
I: [pulseaudio] main.c: This is PulseAudio 13.99.1-rebootstrapped
D: [pulseaudio] main.c: Compilation host: x86_64-redhat-linux-gnu
D: [pulseaudio] main.c: Compilation CFLAGS: -O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -m64 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection -W -Wextra -Wno-long-long -Wno-overlength-strings -Wunsafe-loop-optimizations -Wundef -Wformat=2 -Wlogical-op -Wsign-compare -Wformat-security -Wmissing-include-dirs -Wformat-nonliteral -Wpointer-arith -Winit-self -Wdeclaration-after-statement -Wfloat-equal -Wmissing-prototypes -Wredundant-decls -Wmissing-declarations -Wmissing-noreturn -Wshadow -Wendif-labels -Wcast-align -Wstrict-aliasing -Wwrite-strings -Wno-unused-parameter -fno-common -fdiagnostics-show-option -fdiagnostics-color=auto
D: [pulseaudio] main.c: Running on host: Linux x86_64 4.18.0-240.1.1.el8_3.x86_64 #1 SMP Thu Nov 19 17:20:08 UTC 2020
D: [pulseaudio] main.c: Found 4 CPUs.
I: [pulseaudio] main.c: Page size is 4096 bytes
D: [pulseaudio] main.c: Compiled with Valgrind support: no
D: [pulseaudio] main.c: Running in valgrind mode: no
D: [pulseaudio] main.c: Running in VM: no
D: [pulseaudio] main.c: Running from build tree: no
D: [pulseaudio] main.c: Optimized build: yes
D: [pulseaudio] main.c: FASTPATH defined, only fast path asserts disabled.
I: [pulseaudio] main.c: Machine ID is cf39e64c11dd4d93b45e5727a01fd5e2.
I: [pulseaudio] main.c: Session ID is 15.
I: [pulseaudio] main.c: Using runtime directory /var/run/pulse.
I: [pulseaudio] main.c: Using state directory /var/lib/pulse.
I: [pulseaudio] main.c: Using modules directory /usr/lib64/pulse-13.99/modules.
I: [pulseaudio] main.c: Running in system mode: yes
...

I can't get it working on my intel-nuc running CentOs 8.
strange thing is that I don't have a problem when running the command directly from the command line as user root.

I have the exact same problem. Did you ever manage to fix this?

@koenschepens
I managed to get it working. See my Audio setup here below:

Audio setup

Setup of pulseaudio in user mode

1. Install latest version of pulseaudio

# command to install pulseaudio is:
#           dnf install pulseaudio
# below command returns version of installed pulseaudio
[root@nuc-jan ~]# pulseaudio --version
pulseaudio 13.99.1-rebootstrapped

2. create a specific user for pulseaudio server

useradd -m pulseaudio

3. assure that systemd is running for user pulseaudio at all times (also after reboot)

loginctl enable-linger pulseaudio

# you can check this by below command which should return a line like:
#  pulseau+ 1187308       1  0 10:32 ?        00:00:00 /usr/lib/systemd/systemd --user
ps -ef | grep pulse | grep systemd

4. activate pulseaudio in user mode for user pulseaudio (has uid = 1041 in my case)

[root@nuc-jan ~]# su - pulseaudio
[pulseaudio@nuc-jan ~]$ export XDG_RUNTIME_DIR=/run/user/1041
[pulseaudio@nuc-jan ~]$ systemctl --user enable pulseaudio
Created symlink /home/pulseaudio/.config/systemd/user/default.target.wants/pulseaudio.service → /usr/lib/systemd/user/pulseaudio.service.
Created symlink /home/pulseaudio/.config/systemd/user/sockets.target.wants/pulseaudio.socket → /usr/lib/systemd/user/pulseaudio.socket.
[pulseaudio@nuc-jan ~]$ 

5. Check if pulseaudio socket (=/run/user/1041/pulse/native) is active for user pulseaudio

# assure you are user `pulseaudio` and then enter following command
#     su - pulseaudio
[pulseaudio@nuc-jan ~]$ systemctl --user status pulseaudio.socket
● pulseaudio.socket - Sound System
   Loaded: loaded (/usr/lib/systemd/user/pulseaudio.socket; enabled; vendor preset: enabled)
   Active: active (listening) since Fri 2020-12-18 10:32:23 CET; 3min 53s ago
   Listen: /run/user/1041/pulse/native (Stream)
   CGroup: /user.slice/user-1041.slice/user@1041.service/pulseaudio.socket
[pulseaudio@nuc-jan ~]$

5. give user pulseaudio access to audio group so it has access to audio hardware (/dev/snd/*)

# following command must be executed as user root:
usermod -a -G audio pulseaudio

This can be checked by:

# logon as user pulseaudio
root@nuc-jan ~]# su - pulseaudio
[pulseaudio@nuc-jan ~]$ groups
pulseaudio audio

# check if audio hardware is recognized (it might be needed to install alsa utilities)
[pulseaudio@nuc-jan ~]$ arecord -l
**** List of CAPTURE Hardware Devices ****
card 0: PCH [HDA Intel PCH], device 0: ALC283 Analog [ALC283 Analog]
  Subdevices: 0/1
  Subdevice #0: subdevice #0
[pulseaudio@nuc-jan ~]$ 

6. reboot the system

7. Following command can be used to check if pulseaudio can access audio card
   (assure that no other program is accessing the audio card)

 runuser -l pulseaudio -c 'export XDG_RUNTIME_DIR=/run/user/1041 ; pactl info'

8. NOT NEEDED: Assure that pulseaudio socket is accessible by any user

chmod a+rwx -R /run/user/1041/pulse
chmod a+x /run/pulse/1041

9. Changes to /etc/pulse/daemon.conf

# JVA 2020-12-18 : next line assures that the daemon keeps on running 
exit-idle-time = -1

10. Changes to /etc/pulse/default.pa

# JVA 2020-12-18: added auth-anonymous=true to below line
load-module module-native-protocol-unix auth-anonymous=true

11. reboot the system to check if everything is properly setup

Test pulseaudio installation (including pavucontrol)

12. Check if pulseaudio is running by entering following command as root user on host machine (=nuc-jan)

[root@nuc-jan ~]# export PULSE_SERVER=unix:/run/user/1041/pulse/native; pactl info
Server String: unix:/run/user/1041/pulse/native
Library Protocol Version: 33
Server Protocol Version: 33
Is Local: yes
Client Index: 16
Tile Size: 65472
User Name: pulseaudio
Host Name: nuc-jan.borsbeek
Server Name: pulseaudio
Server Version: 13.99.1-rebootstrapped
Default Sample Specification: s16le 2ch 44100Hz
Default Channel Map: front-left,front-right
Default Sink: alsa_output.pci-0000_00_0e.0.analog-stereo
Default Source: alsa_input.pci-0000_00_0e.0.analog-stereo
Cookie: ded1:9276
[root@nuc-jan ~]# 

13. install pavucontrol on host (pavucontrol cannot be installed in current node-red alpine image !)

dnf install pavucontrol

# assure that XQuartz is running on macbook and 
# that you have enabled remote access (type "xhost +" in xterm window)

# you can then launch pavocontrol by following command
export PULSE_SERVER=unix:/run/user/1041/pulse/native; pavucontrol --display=Jans-MBP.lan:0.0

Accessing pulseaudio server (on host) in docker container

Assure that pulseaudio server (on host) is setup as in previous sections.

1. Add following line to alpine docker image to install pulseaudio and also alsa, sox and pulseaudio utilities.

# https://wiki.alpinelinux.org/wiki/PulseAudio
#  notes:
#     - pavucontrol is not yet available in alpine image used in node-red:1.2.6-12
#     - alsa-plugins-pulse allows to use alsa applications via default pulseaudio
RUN set -ex && apk --no-cache add sox pulseaudio alsa-utils pulseaudio-utils pulseaudio-alsa alsa-plugins-pulse

2. In docker compose file add following lines for the container:

    volumes:
      ...
       # map the location of pulseaudio unix socket to /run/pulseaudio/socket
       - '/run/user/1041/pulse/native:/run/pulseaudio/socket'
    environment:
      ...
      - PULSE_SERVER=unix:/run/pulseaudio/socket

3. You can validate this by opening a console on the container and running below command

bash-5.0$ pactl info
Server String: unix:/run/pulseaudio/socket
Library Protocol Version: 33
Server Protocol Version: 33
Is Local: yes
Client Index: 4
Tile Size: 65472
User Name: pulseaudio
Host Name: nuc-jan.borsbeek
Server Name: pulseaudio
Server Version: 13.99.1-rebootstrapped
Default Sample Specification: s16le 2ch 44100Hz
Default Channel Map: front-left,front-right
Default Sink: alsa_output.pci-0000_00_0e.0.analog-stereo
Default Source: alsa_input.pci-0000_00_0e.0.analog-stereo
Cookie: ded1:9276
bash-5.0$ 

Change pulseaudio profile (using hdmi / analog / digital output)

Here below the commands to change the audio profile of the card.
Note that it is also possible to do this using pavucontrol.

# set profile to use digital output port (S/PDIF)
pactl set-card-profile alsa_card.pci-0000_00_0e.0 output:iec958-stereo+input:analog-stereo

# set profile to use analog output port (headphone)
pactl set-card-profile alsa_card.pci-0000_00_0e.0 output:analog-stereo+input:analog-stereo

# list audio card details (including available profiles)
pactl list cards

# check default sink/source
pactl info

@janvda

Wow thank you so much for the extensive description! I will try it out :)

@janvda
Hello! I have a server with 3 VMs that I want to have sound-enabled. In particular I wanted the VM running my music server to start on boot, and with sound enabled. The audio part of that solution evaded me until I found your post. I i implemented it as described, except for using a different account, and it works beautifully.

Thanks!