Add systemd service file for invidious-companion (#184)

* Initial plan

* Initial analysis - plan systemd service implementation

Co-authored-by: unixfox <[email protected]>

* Add systemd service file and installation documentation

Co-authored-by: unixfox <[email protected]>

* Fix systemd service configuration and add secret key requirement

Co-authored-by: unixfox <[email protected]>

* Add Tor proxy support to systemd service configuration

- Added PROXY environment variable to systemd service for Tor SOCKS5 proxy
- Included comments for both Tor daemon (port 9050) and Tor Browser (port 9150)
- Updated SYSTEMD.md with proxy configuration instructions
- Added support for HTTP, HTTPS, SOCKS4, and SOCKS5 proxies
- Tested systemd service environment variable loading and validation

Co-authored-by: unixfox <[email protected]>

* Test and configure systemd service with Tor proxy on port 9150

Co-authored-by: unixfox <[email protected]>

* Remove Tor proxy configuration from systemd service file

Co-authored-by: unixfox <[email protected]>

* Set CHANGE_ME for SERVER KEY

* Delete SYSTEMD.md

* Remove Systemd service installation reference

Remove Systemd service installation link from README.

---------

Co-authored-by: copilot-swe-agent[bot] <[email protected]>
Co-authored-by: unixfox <[email protected]>

Author: Copilot

.gitignore

@@ -41,3 +41,6 @@ invidious_companion
 test_things/
 config/config.toml
 .cache/
+
+# Temporary files
+*.zip

invidious-companion.service

@@ -0,0 +1,44 @@
+[Unit]
+Description=invidious-companion (companion for Invidious which handle all the video stream retrieval from YouTube servers)
+After=syslog.target
+After=network.target
+
+[Service]
+RestartSec=2s
+Type=simple
+
+User=invidious
+Group=invidious
+
+# Security hardening - balanced approach for Deno applications
+NoNewPrivileges=true
+PrivateDevices=true
+PrivateTmp=true
+ProtectControlGroups=true
+ProtectHostname=true
+ProtectKernelLogs=true
+ProtectKernelModules=true
+ProtectKernelTunables=true
+ProtectSystem=strict
+RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
+RestrictNamespaces=true
+RestrictSUIDSGID=true
+RestrictRealtime=true
+
+# Filesystem access
+BindReadOnlyPaths=/home/invidious/invidious-companion
+BindPaths=/home/invidious/tmp
+BindPaths=/var/tmp/youtubei.js
+
+WorkingDirectory=/home/invidious/invidious-companion
+ExecStart=/home/invidious/invidious-companion/invidious_companion
+
+Environment=SERVER_USE_UNIX_SOCKET=true
+Environment=SERVER_UNIX_SOCKET_PATH=/home/invidious/tmp/invidious-companion.sock
+Environment=SERVER_SECRET_KEY=CHANGE_ME
+Environment=CACHE_DIRECTORY=/var/tmp/youtubei.js
+
+Restart=always
+
+[Install]
+WantedBy=multi-user.target