[Unit]
Description=BlueALSA service
Documentation=man:bluealsa(8)
Requisite=dbus.service
After=bluetooth.service bluealsa-defaults.service
Requires=bluealsa-defaults.service
ConditionPathExists=/storage/.cache/services/bluealsa.conf

# In order to customize BlueALSA D-Bus service one should create an override
# for this systemd unit file. Please note, that in the override file one will
# have to explicitly clear the ExecStart before setting it again. See the
# bluez-alsa wiki for more options.
#
# $ sudo systemctl edit bluealsa
# [Service]
# ExecStart=
# ExecStart=/usr/bin/bluealsa -p a2dp-source -p a2dp-sink -c aptx -c aac -c ldac

[Service]
Type=dbus
BusName=org.bluealsa
EnvironmentFile=/storage/.cache/services/bluealsa.conf
ExecStart=/usr/bin/bluealsa $BLUEALSA_ARGS
Restart=on-failure

# Sandboxing
CapabilityBoundingSet=
IPAddressDeny=any
LockPersonality=true
MemoryDenyWriteExecute=true
NoNewPrivileges=true
PrivateDevices=true
PrivateTmp=true
PrivateUsers=true
ProtectControlGroups=true
ProtectHome=true
ProtectHostname=true
ProtectKernelLogs=true
ProtectKernelModules=true
ProtectKernelTunables=true
ProtectSystem=strict
RestrictAddressFamilies=AF_UNIX AF_BLUETOOTH
RestrictNamespaces=true
RestrictRealtime=true
RestrictSUIDSGID=true
SystemCallArchitectures=native
SystemCallErrorNumber=EPERM
SystemCallFilter=@system-service
SystemCallFilter=~@resources @privileged
UMask=0077

[Install]
WantedBy=bluetooth.target