# systemd unit for gled-server on a Raspberry Pi 5, or any Debian-like machine.
#
# install -m 0644 gled-server.service /etc/systemd/system/
# systemctl daemon-reload && systemctl enable --now gled-server
#
# Runs as the unprivileged `gled` user. The supplementary groups are the ones
# Raspberry Pi OS gives the GPU render node (render, video), ALSA and MIDI
# (audio) and USB serial DMX interfaces (dialout).
[Unit]
Description=gled light installation server
After=network-online.target
Wants=network-online.target
# A Pi that was unplugged must come back, however often it had to restart.
StartLimitIntervalSec=0
[Service]
Type=simple
User=gled
Group=gled
SupplementaryGroups=render video audio dialout plugdev
# HTTPS on 443 because browsers only offer WebGPU on a secure origin. Port 80
# redirects to it, so http://gled.local works as an address.
ExecStart=/usr/local/bin/gled-server --data-dir /var/lib/gled --https-listen 0.0.0.0:443 --http-listen 0.0.0.0:80
WorkingDirectory=/var/lib/gled
Restart=always
RestartSec=3
Environment=RUST_LOG=info
Environment=HOME=/var/lib/gled
StateDirectory=gled
StateDirectoryMode=0750
UMask=0027
# Ports 80 and 443 are the only privilege kept.
AmbientCapabilities=CAP_NET_BIND_SERVICE
CapabilityBoundingSet=CAP_NET_BIND_SERVICE
NoNewPrivileges=yes
ProtectSystem=strict
ProtectHome=yes
PrivateTmp=yes
ProtectKernelModules=yes
ProtectKernelLogs=yes
ProtectControlGroups=yes
ProtectClock=yes
ProtectHostname=yes
RestrictNamespaces=yes
RestrictSUIDSGID=yes
LockPersonality=yes
SystemCallArchitectures=native
SystemCallFilter=@system-service
SystemCallErrorNumber=EPERM
# Art-Net, OSC, HTTP and Ableton Link (UDP multicast), and netlink for
# libudev's serial port enumeration.
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
# Only the device nodes it needs: the DRM render node (Vulkan), ALSA including
# the sequencer (audio input, MIDI), and USB serial (Enttec DMX USB Pro is FTDI,
# so ttyUSB; some interfaces are CDC-ACM).
DevicePolicy=closed
DeviceAllow=char-drm rw
DeviceAllow=char-alsa rw
DeviceAllow=char-ttyUSB rw
DeviceAllow=char-ttyACM rw
# Deliberately not set: MemoryDenyWriteExecute (Mesa compiles shaders to
# machine code), PrivateDevices (would hide /dev/dri).
[Install]
WantedBy=multi-user.target