[Unit]
Description=Kodi RK3588 GBM appliance
Documentation=https://github.com/armsurvivors/kodi-rockchip-deb
Wants=network-online.target
After=systemd-user-sessions.service network-online.target sound.target
Conflicts=display-manager.service getty@tty1.service

[Service]
Type=simple
User=kodi
Group=kodi
SupplementaryGroups=video render audio input
Environment=HOME=/var/lib/kodi
Environment=XDG_RUNTIME_DIR=/run/kodi
Environment=LD_LIBRARY_PATH=/opt/rkmedia/lib
EnvironmentFile=-/etc/rkmedia/kodi.env
RuntimeDirectory=kodi
RuntimeDirectoryMode=0700
StateDirectory=kodi
StateDirectoryMode=0750
CacheDirectory=kodi
CacheDirectoryMode=0750
PAMName=login
UtmpIdentifier=tty1
UtmpMode=user
StandardInput=tty
TTYPath=/dev/tty1
TTYReset=yes
TTYVHangup=yes
TTYVTDisallocate=yes
ExecStart=/opt/rkmedia/bin/kodi-rk --standalone --logging=console --windowing=gbm --audio-backend=alsa
Restart=always
RestartSec=2s
TimeoutStopSec=15s
LimitNOFILE=16384
NoNewPrivileges=yes
PrivateTmp=yes
ProtectSystem=full
ProtectHome=yes
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectControlGroups=yes
RestrictNamespaces=yes
RestrictSUIDSGID=yes
LockPersonality=yes
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
CapabilityBoundingSet=CAP_SYS_TTY_CONFIG
AmbientCapabilities=CAP_SYS_TTY_CONFIG

[Install]
WantedBy=multi-user.target