packaging: add debian and homebrew releases (#437)

* docker: add ruby and fpm

* packaging: add deb files

* Makefile: fix architecture specified

* WIP aptly stuff

* Makefile: aptly publishing

* Makefile: working apt repo management

* Makefile: fiddly fixes

* Makefile: forgot to quote

* docs: add debian installation instructions

* docs: fix formatting

* test homebrew action

* test homebrew action 2

* fix ssh config from makefile

* STREAMPLACE_VERSION_OVERRIDE

* clone over ssh

* lol

* done!

.ci/dockerfile-hash.yaml

···
 variables:
-  DOCKERFILE_HASH: 49b462c266c7cdc7ab05eaeb02dd8e3ffb8bcb82
+  DOCKERFILE_HASH: af492185d8fb948d84acace9029719df5d5dbf05

.gitlab-ci.yml

···
   script:
     - rm -rf /usr/x86_64-w64-mingw32/include/d3dcompiler.h /usr/share/mingw-w64/include/d3dcompiler.h /usr/lib/gcc/x86_64-w64-mingw32/10-posix/libssp.dll.a /usr/lib/gcc/x86_64-w64-mingw32/10-posix/libssp-0.dll /usr/lib/gcc/x86_64-w64-mingw32/10-win32/libssp-0.dll /usr/lib/gcc/x86_64-w64-mingw32/10-win32/libssp.dll.a
     - git fetch --unshallow || echo 'already unshallow'
-    - bash -c "make version && make app && make $TARGET && make desktop-$TARGET && make ci-upload-node-$TARGET -j$(nproc)"
+    - bash -c "make version && make app && make $TARGET && make desktop-$TARGET && make pkg-$TARGET && make ci-upload-node-$TARGET -j$(nproc)"
   artifacts:
     reports:
       dotenv: .ci/build.env
···
     - .release-template
   script:
     - make ci-release
+
+deb-release:
+  extends:
+    - .release-template
+  script:
+    - make ci-deb-release
+
+homebrew-release:
+  extends:
+    - .release-template
+  script:
+    - make ci-homebrew
 
 .report-status:
   tags:

Makefile

···
 default: app node
 
 VERSION?=$(shell go run ./pkg/config/git/git.go -v)
+VERSION_NO_V=$(subst v,,$(VERSION))
 VERSION_ELECTRON=$(subst -,-z,$(subst v,,$(VERSION)))
 UUID?=$(shell go run ./pkg/config/uuid/uuid.go)
 BRANCH?=$(shell go run ./pkg/config/git/git.go --branch)
···
 		-t dist.stream.place/streamplace/streamplace:mistserver \
 		.
 
+FPM_BASE_OPTS= \
+	-s dir \
+	-t deb \
+	-v $(VERSION_NO_V) \
+	--force \
+	--license=GPL-3.0-or-later \
+	--maintainer="Streamplace <[e-mail]>" \
+	--vendor="Streamplace" \
+	--url="https://stream.place"
+SP_ARCH_NAME?=amd64
+.PHONY: deb-pkg
+deb-pkg:
+	fpm $(FPM_BASE_OPTS) \
+		-n streamplace \
+		-a $(SP_ARCH_NAME) \
+		-p bin/streamplace-$(VERSION)-linux-$(SP_ARCH_NAME).deb \
+		--deb-systemd=util/systemd/streamplace.service \
+		--deb-systemd-auto-start \
+		--deb-systemd-enable \
+		--deb-systemd-restart-after-upgrade \
+		--after-install=util/systemd/after-install.sh \
+		--description="Live video for the AT Protocol. Solving video for everybody forever." \
+		build-linux-$(SP_ARCH_NAME)/streamplace=/usr/bin/streamplace \
+	&& fpm $(FPM_BASE_OPTS) \
+		-n streamplace-default-http \
+		-a $(SP_ARCH_NAME) \
+		-d streamplace \
+		--deb-systemd-auto-start \
+		--deb-systemd-enable \
+		--deb-systemd-restart-after-upgrade \
+		-p bin/streamplace-default-http-$(VERSION)-linux-$(SP_ARCH_NAME).deb \
+		--description="Installing this package will install Streamplace as the default HTTP server on ports 80 and 443." \
+		util/systemd/streamplace-http.socket=/lib/systemd/system/streamplace-http.socket \
+		util/systemd/streamplace-https.socket=/lib/systemd/system/streamplace-https.socket
+
+.PHONY: pkg-linux-amd64
+pkg-linux-amd64:
+	$(MAKE) deb-pkg SP_ARCH_NAME=amd64
+
+.PHONY: pkg-linux-arm64
+pkg-linux-arm64:
+	$(MAKE) deb-pkg SP_ARCH_NAME=arm64
+
+.PHONY: pkg-darwin-amd64
+pkg-darwin-amd64:
+	echo todo
+
+.PHONY: pkg-darwin-arm64
+pkg-darwin-arm64:
+	echo todo
+
+.PHONY: pkg-windows-amd64
+pkg-windows-amd64:
+	echo todo
+
 .PHONY: ci-upload
 ci-upload: ci-upload-node ci-upload-android
 
 .PHONY: ci-upload-node-linux-amd64
 ci-upload-node-linux-amd64:
-	export file=streamplace-$(VERSION)-linux-amd64.tar.gz \
-	&& $(MAKE) ci-upload-file upload_file=$$file; \
-	export file=streamplace-desktop-$(VERSION)-linux-amd64.AppImage \
-	&& $(MAKE) ci-upload-file upload_file=$$file;
+	$(MAKE) ci-upload-file upload_file=streamplace-$(VERSION)-linux-amd64.tar.gz \
+	&& $(MAKE) ci-upload-file upload_file=streamplace-desktop-$(VERSION)-linux-amd64.AppImage \
+	&& $(MAKE) ci-upload-file upload_file=streamplace-default-http-$(VERSION)-linux-amd64.deb \
+	&& $(MAKE) ci-upload-file upload_file=streamplace-$(VERSION)-linux-amd64.deb
 
 .PHONY: ci-upload-node-linux-arm64
 ci-upload-node-linux-arm64:
-	export file=streamplace-$(VERSION)-linux-arm64.tar.gz \
-	&& $(MAKE) ci-upload-file upload_file=$$file; \
-	export file=streamplace-desktop-$(VERSION)-linux-arm64.AppImage \
-	&& $(MAKE) ci-upload-file upload_file=$$file;
+	$(MAKE) ci-upload-file upload_file=streamplace-$(VERSION)-linux-arm64.tar.gz \
+	&& $(MAKE) ci-upload-file upload_file=streamplace-desktop-$(VERSION)-linux-arm64.AppImage \
+	&& $(MAKE) ci-upload-file upload_file=streamplace-default-http-$(VERSION)-linux-arm64.deb \
+	&& $(MAKE) ci-upload-file upload_file=streamplace-$(VERSION)-linux-arm64.deb
 
 .PHONY: ci-upload-node-darwin-arm64
 ci-upload-node-darwin-arm64:
···
 		--upload-file bin/$(upload_file) \
 		"$$CI_API_V4_URL/projects/$$CI_PROJECT_ID/packages/generic/$(BRANCH)/$(VERSION)/$(upload_file)";
 
+download_file?=""
+.PHONY: ci-download-file
+ci-download-file:
+	curl \
+		--fail-with-body \
+		--header "JOB-TOKEN: $$CI_JOB_TOKEN" \
+		-o bin/$(download_file) \
+		"$$CI_API_V4_URL/projects/$$CI_PROJECT_ID/packages/generic/$(BRANCH)/$(VERSION)/$(download_file)";
+
 .PHONY: release
 release: install
 	$(MAKE) lexicons
···
 	go run ./pkg/config/git/git.go -release -o release.yml
 	release-cli create-from-file --file release.yml
 
+.PHONY: deb-release
+deb-release:
+	aptly repo create -distribution=all -component=main streamplace-releases
+	aptly mirror create old-version $$S3_PUBLIC_URL/debian all
+	aptly mirror update old-version
+	aptly repo import old-version streamplace-releases streamplace streamplace-default-http
+	aptly repo add streamplace-releases \
+		bin/streamplace-default-http-$(VERSION)-linux-arm64.deb \
+		bin/streamplace-$(VERSION)-linux-arm64.deb \
+		bin/streamplace-default-http-$(VERSION)-linux-amd64.deb \
+		bin/streamplace-$(VERSION)-linux-amd64.deb
+	aptly snapshot create streamplace-$(VERSION) from repo streamplace-releases
+	aptly publish snapshot -distribution=all streamplace-$(VERSION) s3:streamplace-releases:
+
+.PHONY: ci-deb-release
+ci-deb-release:
+	$(MAKE) ci-download-file download_file=streamplace-default-http-$(VERSION)-linux-amd64.deb
+	$(MAKE) ci-download-file download_file=streamplace-$(VERSION)-linux-amd64.deb
+	$(MAKE) ci-download-file download_file=streamplace-default-http-$(VERSION)-linux-arm64.deb
+	$(MAKE) ci-download-file download_file=streamplace-$(VERSION)-linux-arm64.deb
+	echo $$CI_SIGNING_KEY_BASE64 | base64 -d | gpg --import
+	gpg --armor --export | gpg --no-default-keyring --keyring trustedkeys.gpg --import
+	echo '{"S3PublishEndpoints":{"streamplace-releases":{"region":"'$$S3_REGION'","bucket":"'$$S3_BUCKET_NAME'","endpoint":"'$$S3_ENDPOINT'","acl":"public-read","prefix":"debian"}}}' > ~/.aptly.conf
+	$(MAKE) deb-release
+
 .PHONY: check
 check: install
 	$(MAKE) golangci-lint
···
 .PHONY: rtcrec
 rtcrec:
 	go build -o $(BUILDDIR)/rtcrec ./pkg/rtcrec/cmd/...
+
+.PHONY: homebrew
+homebrew:
+	$(MAKE) ci-download-file download_file=streamplace-$(VERSION)-linux-amd64.tar.gz
+	$(MAKE) ci-download-file download_file=streamplace-$(VERSION)-linux-arm64.tar.gz
+	$(MAKE) ci-download-file download_file=streamplace-$(VERSION)-darwin-amd64.tar.gz
+	$(MAKE) ci-download-file download_file=streamplace-$(VERSION)-darwin-arm64.tar.gz
+	git clone [e-mail]:streamplace/homebrew-streamplace.git /tmp/homebrew-streamplace
+	go run ./pkg/config/git/git.go -homebrew -o /tmp/homebrew-streamplace/Formula/streamplace.rb
+
+.PHONY: ci-homebrew
+ci-homebrew:
+	git config --global user.name "Streamplace Homebrew Robot"
+	git config --global user.email [e-mail]
+	mkdir -p ~/.ssh
+	echo "Host * \n\
+	  StrictHostKeyChecking no \n\
+	  UserKnownHostsFile=/dev/null" > ~/.ssh/config
+	echo "$$CI_HOMEBREW_KEY_BASE64" | base64 -d > ~/.ssh/id_ed25519
+	chmod 600 ~/.ssh/id_ed25519
+
+	chmod 600 ~/.ssh/config
+	$(MAKE) homebrew
+	cd /tmp/homebrew-streamplace \
+	&& git add . \
+	&& git commit -m "Update streamplace $(VERSION)" \
+	&& git push

docker/build.Dockerfile

···
   mono-runtime nuget mono-xsp4 squashfs-tools \
   libc6:arm64 libstdc++6:arm64 \
   cmake libssl-dev libssl-dev:arm64 \
+  ruby-rubygems \
   && pip install meson tomli \
   && curl -L --fail https://go.dev/dl/go$GO_VERSION.linux-$TARGETARCH.tar.gz -o go.tar.gz \
   && tar -C /usr/local -xf go.tar.gz \
···
   && tar -xf golangci-lint.tar.gz \
   && mv golangci-lint-2.1.6-linux-amd64/golangci-lint /usr/local/bin/ \
   && rm -rf golangci-lint.tar.gz golangci-lint-2.1.6-linux-amd64
+
+RUN gem install fpm
+ENV APTLY_VERSION 1.6.2
+RUN curl --fail -L https://github.com/aptly-dev/aptly/releases/download/v${APTLY_VERSION}/aptly_${APTLY_VERSION}_linux_amd64.zip -o aptly.zip \
+  && unzip aptly.zip \
+  && mv aptly_${APTLY_VERSION}_linux_amd64/aptly /usr/local/bin/ \
+  && rm -rf aptly.zip aptly_${APTLY_VERSION}_linux_amd64
 
 ENV COREPACK_ENABLE_DOWNLOAD_PROMPT=false
 

js/docs/astro.config.mjs

···
               autogenerate: { directory: "guides/start-streaming" },
             },
             {
+              label: "Installing Streamplace",
+              autogenerate: { directory: "guides/installing" },
+            },
+            {
               label: "Start Contributing",
               autogenerate: { directory: "guides/start-contributing" },
             },

js/docs/src/content/docs/guides/installing/downloading-streamplace.md

···
+---
+title: Downloading Streamplace
+description: How to download Streamplace
+sidebar:
+  order: 20
+---
+
+## macOS
+
+```shell
+brew install streamplace/streamplace/streamplace
+```
+
+## Linux
+
+We distribute two Linux packages for Streamplace:
+
+- `streamplace`, which is the main Streamplace binary.
+- `streamplace-default-http`, which includes some additional systemd
+  configuration to make Streamplace your default HTTP server on ports 80
+  and 443.
+
+If you're looking to set up a Streamplace node on a server that isn't hosting
+any other services, we'd recommend e.g.
+`apt install streamplace streamplace-default-http`. If your server is hosting
+other HTTP servers and you'll handle the proxying yourself, you can simply
+`apt install streamplace`.
+
+### Debian/Ubuntu
+
+```shell
+sudo mkdir -p /etc/apt/keyrings
+curl https://release.stream.place/streamplace.key | sudo gpg --dearmor -o /etc/apt/keyrings/streamplace.key
+echo 'deb [signed-by=/etc/apt/keyrings/streamplace.key] https://release.stream.place/debian/ all main' \
+  | sudo tee /etc/apt/sources.list.d/streamplace.list
+sudo apt update
+sudo apt install streamplace
+```
+
+## Download a binary
+
+Binaries for all platforms are available to download from
+[our GitLab server](https://git.stream.place/streamplace/streamplace/-/releases).

js/docs/src/content/docs/index.mdx

···
 ## Next Steps
 
 <CardGrid>
-  <Card title="Start Streaming" icon="rss">
-    Stream live, on the ATProtocol.
-  </Card>
   <Card title="Read the Docs" icon="open-book">
     Learn how to start streaming with
     [Streamplace](/docs/guides/start-streaming/obs).
+  </Card>
+  <Card title="Install Streamplace" icon="download">
+    [Run your own Streamplace
+    node](/docs/guides/installing/installing-streamplace).
   </Card>
   <Card title="API Reference" icon="document">
     Explore the [Lexicon API reference](/docs/lex-reference/place-stream-defs).

pkg/api/api.go

···
 	"net/http/httputil"
 	"net/url"
 	"os"
+	"strconv"
 	"strings"
 	"sync"
 	"time"
···
 	}
 }
 
+// helper for getting a listener from a systemd file descriptor
+func getListenerFromFD(fdName string) (net.Listener, error) {
+	log.Log(context.TODO(), "getting listener from fd", "fdName", fdName, "LISTEN_PID", os.Getenv("LISTEN_PID"), "LISTEN_FDNAMES", os.Getenv("LISTEN_FDNAMES"))
+	if os.Getenv("LISTEN_PID") == strconv.Itoa(os.Getpid()) {
+		names := strings.Split(os.Getenv("LISTEN_FDNAMES"), ":")
+		for i, name := range names {
+			if name == fdName {
+				f1 := os.NewFile(uintptr(i+3), fdName)
+				return net.FileListener(f1)
+			}
+		}
+	}
+	return nil, nil
+}
+
 func (a *StreamplaceAPI) ServeHTTP(ctx context.Context) error {
 	handler, err := a.Handler(ctx)
 	if err != nil {
 		return err
 	}
 	return a.ServerWithShutdown(ctx, handler, func(s *http.Server) error {
-		s.Addr = a.CLI.HTTPAddr
-		log.Log(ctx, "http server starting", "addr", s.Addr)
-		return s.ListenAndServe()
+		ln, err := getListenerFromFD("http")
+		if err != nil {
+			return err
+		}
+		if ln == nil {
+			ln, err = net.Listen("tcp", a.CLI.HTTPAddr)
+			if err != nil {
+				return err
+			}
+		} else {
+			log.Warn(ctx, "api server listening for http over systemd socket", "addr", ln.Addr())
+		}
+		log.Log(ctx, "http server starting", "addr", ln.Addr())
+		return s.Serve(ln)
 	})
 }
 
···
 		return err
 	}
 	return a.ServerWithShutdown(ctx, handler, func(s *http.Server) error {
-		s.Addr = a.CLI.HTTPAddr
-		log.Log(ctx, "http tls redirecct server starting", "addr", s.Addr)
-		return s.ListenAndServe()
+		ln, err := getListenerFromFD("http")
+		if err != nil {
+			return err
+		}
+		if ln == nil {
+			ln, err = net.Listen("tcp", a.CLI.HTTPAddr)
+			if err != nil {
+				return err
+			}
+		} else {
+			log.Warn(ctx, "http tls redirect server listening for http over systemd socket", "addr", ln.Addr())
+		}
+		log.Log(ctx, "http tls redirect server starting", "addr", ln.Addr())
+		return s.Serve(ln)
 	})
 }
 
···
 		return err
 	}
 	return a.ServerWithShutdown(ctx, handler, func(s *http.Server) error {
-		s.Addr = a.CLI.HTTPSAddr
+		ln, err := getListenerFromFD("https")
+		if err != nil {
+			return err
+		}
+		if ln == nil {
+			ln, err = net.Listen("tcp", a.CLI.HTTPSAddr)
+			if err != nil {
+				return err
+			}
+		} else {
+			log.Warn(ctx, "https server listening for https over systemd socket", "addr", ln.Addr())
+		}
 		log.Log(ctx, "https server starting",
-			"addr", s.Addr,
+			"addr", ln.Addr(),
 			"certPath", a.CLI.TLSCertPath,
 			"keyPath", a.CLI.TLSKeyPath,
 		)
-		return s.ListenAndServeTLS(a.CLI.TLSCertPath, a.CLI.TLSKeyPath)
+		return s.ServeTLS(ln, a.CLI.TLSCertPath, a.CLI.TLSKeyPath)
 	})
 }
 

pkg/config/git/git.go

···
 package main
 
 import (
+	"bytes"
+	"crypto/sha256"
 	"encoding/json"
 	"flag"
 	"fmt"
+	"io"
 	"math/rand"
 	"net/http"
 	"os"
 	"sort"
 	"strings"
+	"text/template"
 
 	"github.com/go-git/go-git/v5"
 	"github.com/go-git/go-git/v5/plumbing"
···
 	doBranch := flag.Bool("branch", false, "print branch")
 	doRelease := flag.Bool("release", false, "print release json file")
 	javascript := flag.Bool("js", false, "print code in javascript format")
+	homebrew := flag.Bool("homebrew", false, "print homebrew formula")
 
 	flag.Parse()
 	r, err := git.PlainOpenWithOptions(".", &git.PlainOpenOptions{DetectDotGit: true})
···
 		out = string(bs)
 	} else if *javascript {
 		out = fmt.Sprintf(tmplJS, desc, ts, u)
+	} else if *homebrew {
+		bs := bytes.Buffer{}
+		versionNoV := strings.TrimPrefix(desc, "v")
+		darwinAmd64File := fmt.Sprintf("streamplace-%s-darwin-amd64.tar.gz", desc)
+		darwinArm64File := fmt.Sprintf("streamplace-%s-darwin-arm64.tar.gz", desc)
+		linuxAmd64File := fmt.Sprintf("streamplace-%s-linux-amd64.tar.gz", desc)
+		linuxArm64File := fmt.Sprintf("streamplace-%s-linux-arm64.tar.gz", desc)
+
+		err = homebrewTmpl.Execute(&bs, Homebrew{
+			Version:     versionNoV,
+			DarwinArm64: getHash(darwinArm64File),
+			DarwinAmd64: getHash(darwinAmd64File),
+			LinuxArm64:  getHash(linuxArm64File),
+			LinuxAmd64:  getHash(linuxAmd64File),
+		})
+		if err != nil {
+			return err
+		}
+		out = bs.String()
 	} else {
 		out = fmt.Sprintf(tmpl, desc, ts, u)
 	}
···
 	return nil
 }
 
+func getHash(fileName string) string {
+	filePath := fmt.Sprintf("bin/%s", fileName)
+	f, err := os.Open(filePath)
+	if err != nil {
+		panic(err)
+	}
+	defer f.Close()
+
+	h := sha256.New()
+	buf := make([]byte, 1024*1024) // 1MB buffer
+
+	for {
+		n, err := f.Read(buf)
+		if n > 0 {
+			if _, err := h.Write(buf[:n]); err != nil {
+				panic(err)
+			}
+		}
+		if err != nil {
+			if err == io.EOF {
+				break
+			}
+			panic(err)
+		}
+	}
+
+	return fmt.Sprintf("%x", h.Sum(nil))
+}
+
 func branch() string {
 	CICommitTag := os.Getenv("CI_COMMIT_TAG")
 	CICommitBranch := os.Getenv("CI_COMMIT_BRANCH")
···
 
 // Describe the reference as 'git describe --tags' will do
 func (g *Git) Describe(reference *plumbing.Reference) (string, error) {
+	if os.Getenv("STREAMPLACE_VERSION_OVERRIDE") != "" {
+		return os.Getenv("STREAMPLACE_VERSION_OVERRIDE"), nil
+	}
 
 	// Fetch the reference log
 	cIter, err := g.Log(&git.LogOptions{
···
 		), nil
 	}
 }
+
+type Homebrew struct {
+	Version     string
+	DarwinArm64 string
+	DarwinAmd64 string
+	LinuxArm64  string
+	LinuxAmd64  string
+}
+
+var homebrewTmpl = template.Must(template.New("homebrew").Parse(`
+class Streamplace < Formula
+  desc "Live video for the AT Protocol. Solving video for everybody forever."
+  homepage "https://stream.place"
+  license "GPL-3.0-or-later"
+  version "{{.Version}}"
+
+  on_macos do
+    if Hardware::CPU.arm?
+      url "https://git-cloudflare.stream.place/api/v4/projects/1/packages/generic/latest/v{{.Version}}/streamplace-v{{.Version}}-darwin-arm64.tar.gz"
+      sha256 "{{.DarwinArm64}}"
+    end
+
+    if Hardware::CPU.intel?
+      url "https://git-cloudflare.stream.place/api/v4/projects/1/packages/generic/latest/v{{.Version}}/streamplace-v{{.Version}}-darwin-amd64.tar.gz"
+      sha256 "{{.DarwinAmd64}}"
+    end
+  end
+
+  on_linux do
+    if Hardware::CPU.arm? && Hardware::CPU.is_64_bit?
+      url "https://git-cloudflare.stream.place/api/v4/projects/1/packages/generic/latest/v{{.Version}}/streamplace-v{{.Version}}-linux-arm64.tar.gz"
+      sha256 "{{.LinuxArm64}}"
+    end
+
+    if Hardware::CPU.intel?
+      url "https://git-cloudflare.stream.place/api/v4/projects/1/packages/generic/latest/v{{.Version}}/streamplace-v{{.Version}}-linux-amd64.tar.gz"
+      sha256 "{{.LinuxAmd64}}"
+    end
+  end
+
+  def install
+    bin.install "streamplace" => "streamplace"
+  end
+end
+`))

util/systemd/after-install.sh

···
+#!/bin/sh
+
+set -e
+
+# Create streamplace group if it doesn't exist
+if ! getent group streamplace >/dev/null; then
+    groupadd streamplace
+fi
+
+# Create streamplace user if it doesn't exist
+if ! getent passwd streamplace >/dev/null; then
+    useradd -r -g streamplace -d /var/lib/streamplace -s /sbin/nologin streamplace
+fi
+
+mkdir -p /var/lib/streamplace
+mkdir -p /etc/streamplace
+chown -R streamplace:streamplace /var/lib/streamplace
+
+# Create default environment file if it doesn't exist
+if [ ! -f /etc/streamplace/streamplace.env ]; then
+    echo "# Configure your Streamplace instance by creating lines such as:" > /etc/streamplace/streamplace.env
+    echo "# SP_PUBLIC_HOST=example.com" >> /etc/streamplace/streamplace.env
+fi

util/systemd/streamplace-http.socket

···
+[Unit]
+Description=streamplace http socket
+
+[Socket]
+ListenStream=80
+FileDescriptorName=http
+Service=streamplace.service
+
+[Install]
+WantedBy=sockets.target

util/systemd/streamplace-https.socket

···
+[Unit]
+Description=streamplace https socket
+
+[Socket]
+ListenStream=443
+FileDescriptorName=https
+Service=streamplace.service
+
+[Install]
+WantedBy=sockets.target

util/systemd/streamplace.service

···
+[Unit]
+Description=Live video for the AT Protocol. Solving video for everybody forever.
+Documentation=https://stream.place/docs
+After=network-online.target
+Wants=network-online.target
+Wants=streamplace-http.socket streamplace-https.socket
+Requires=network.target
+
+[Service]
+Type=exec
+ExecStart=/usr/bin/streamplace
+Restart=always
+RestartSec=3
+TimeoutStartSec=60
+TimeoutStopSec=30
+
+User=streamplace
+Group=streamplace
+
+# Environment
+Environment=SP_DATA_DIR=/var/lib/streamplace
+
+# Additional environment file for user customization
+EnvironmentFile=-/etc/streamplace/streamplace.env
+
+# Security hardening
+NoNewPrivileges=yes
+ProtectSystem=strict
+ProtectHome=yes
+ProtectKernelTunables=yes
+ProtectKernelModules=yes
+ProtectControlGroups=yes
+RestrictRealtime=yes
+RestrictSUIDSGID=yes
+RemoveIPC=yes
+PrivateTmp=yes
+
+# Allow access to necessary directories
+ReadWritePaths=/var/lib/streamplace
+ReadOnlyPaths=/etc/streamplace
+
+# Network access
+PrivateNetwork=no
+RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
+
+# Resource limits
+LimitNOFILE=65536
+LimitNPROC=4096
+
+# Logging
+StandardOutput=journal
+StandardError=journal
+SyslogIdentifier=streamplace
+
+# Working directory
+WorkingDirectory=/var/lib/streamplace
+
+[Install]
+WantedBy=multi-user.target