Jellyfin Systemd hardening override files

01-harden.conf

[Service]
# Prevent gaining extra privileges or executing setuid binaries.
NoNewPrivileges=yes

# Separate /tmp and /var/tmp
PrivateTmp=yes

# Make most of the filesystem read-only; whitelist writable paths below.
ProtectSystem=strict

# Disallow access to users homes.
ProtectHome=yes

# Deny access to kernel logs (dmesg)
ProtectKernelLogs=yes

# Harden kernel and cgroup access.
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectControlGroups=yes
ProtectHostname=yes
ProtectClock=yes

# Tighten various privilege-related features.
RestrictSUIDSGID=yes
RestrictRealtime=yes

# Limit network families
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6

02-restrict-paths.conf

[Service]
# Restrict paths
ReadOnlyPaths = /tank
InaccessiblePaths = /tank/backup

override.conf

[Service]
# Create writable standard dirs for the service-user
# Needs User= to be defined

# RuntimeDirectory=jellyfin
StateDirectory=jellyfin
CacheDirectory=jellyfin
LogsDirectory=jellyfin
ConfigurationDirectory=jellyfin

# Limit network families
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK