7ab28d30a7
Stop upgrade-search from queuing mid-confidence matches that approve cannot honor (owned movies/episodes 409'd on the TUI). De-dupe pending review rows, scope 1080p gates to the target episode, refuse unsafe pack cleanup, and require a token for non-loopback binds.
30 lines
988 B
Desktop File
30 lines
988 B
Desktop File
[Unit]
|
|
Description=breadarr media acquisition daemon
|
|
After=network-online.target
|
|
Wants=network-online.target
|
|
|
|
[Service]
|
|
Type=simple
|
|
ExecStart=/usr/bin/breadarrd
|
|
# `always`, not `on-failure` — a clean-but-wrong exit (e.g. the background
|
|
# grab/import loop falling out of its own retry logic) should still trigger
|
|
# a restart, not leave the daemon dead until someone notices by hand.
|
|
Restart=always
|
|
RestartSec=2
|
|
# 0022, not a restrictive 0077 — breadarrd writes into media library folders
|
|
# that Jellyfin (or another user/process) needs to read.
|
|
UMask=0022
|
|
RuntimeDirectory=breadarr
|
|
RuntimeDirectoryMode=0700
|
|
KillSignal=SIGTERM
|
|
# Transcode jobs can run for minutes; 5s was cutting them off on stop.
|
|
TimeoutStopSec=180
|
|
# Modest hardening valid in a user unit. Skip ProtectHome (library +
|
|
# config live under $HOME) and MemoryDenyWriteExecute (ort/onnxruntime
|
|
# may need JIT / RWX mappings).
|
|
NoNewPrivileges=yes
|
|
RestrictSUIDSGID=yes
|
|
LockPersonality=yes
|
|
|
|
[Install]
|
|
WantedBy=default.target
|