owncast.service

[Unit]
Description=Owncast Service

[Service]
Type=simple
WorkingDirectory=/home/owncast/owncast
ExecStart=go run main.go
Restart=on-failure
RestartSec=25
User=owncast
CapabilityBoundingSet=
DeviceAllow=/dev/stdin
DevicePolicy=strict
NoNewPrivileges=true
PrivateTmp=true
PrivateDevices=true
PrivateUsers=true
ProtectClock=true
ProtectControlGroups=true
#ProtectHome=true
ProtectKernelModules=true
ProtectKernelTunables=true
ProtectKernelLogs=true
ProtectProc=invisible
ProtectSystem=yes
RestrictAddressFamilies=AF_INET AF_INET6
RestrictNamespaces=yes
SystemCallArchitectures=native
SystemCallFilter=~@clock
SystemCallFilter=~@debug
SystemCallFilter=~@module
SystemCallFilter=~@mount
SystemCallFilter=~@raw-io
SystemCallFilter=~@reboot
SystemCallFilter=~@swap
SystemCallFilter=~@privileged
SystemCallFilter=~@cpu-emulation
SystemCallFilter=~@obsolete
LockPersonality=true
MemoryDenyWriteExecute=true
RemoveIPC=true
UMask=0077

[Install]
WantedBy=multi-user.target