[Unit]
Description=ReFrame Remote Desktop Streamer for %i
After=reframe@%i.socket
Requires=reframe@%i.socket

[Service]
Type=exec
# We have to run this as root to get permissions on `/dev/dri/card*` and
# `/dev/uinput`, then we drop all unused permissions.
#
# `CAP_SYS_ADMIN` is used for DRM, `CAP_SYS_PTRACE` is used for
# `/proc/<pid>/exe`.
CapabilityBoundingSet=CAP_SYS_ADMIN CAP_SYS_PTRACE
ProtectHome=true
ProtectSystem=strict
ProtectControlGroups=true
ProtectKernelTunables=true
DeviceAllow=char-drm r
DeviceAllow=/dev/uinput rw
ExecStart=@bindir@/reframe-streamer --config=@confdir@/%i.conf --socket=%t/reframe/%i.sock
Restart=on-failure

[Install]
WantedBy=multi-user.target
