Fix systemd service configuration and add secret key requirement

Co-authored-by: unixfox <[email protected]>

Author: Copilot

invidious-companion.service

@@ -10,64 +10,22 @@ Type=simple
 User=invidious
 Group=invidious
 
-# allow only the strict necessary since this service handles YouTube content
-CapabilityBoundingSet=~CAP_SETUID CAP_SETGID CAP_SETPCAP
-CapabilityBoundingSet=~CAP_SYS_ADMIN
-CapabilityBoundingSet=~CAP_SYS_PTRACE
-CapabilityBoundingSet=~CAP_CHOWN CAP_FSETID CAP_SETFCAP
-CapabilityBoundingSet=~CAP_DAC_OVERRIDE CAP_DAC_READ_SEARCH CAP_FOWNER CAP_IPC_OWNER
-CapabilityBoundingSet=~CAP_NET_ADMIN
-CapabilityBoundingSet=~CAP_SYS_MODULE
-CapabilityBoundingSet=~CAP_SYS_RAWIO
-CapabilityBoundingSet=~CAP_SYS_TIME
-CapabilityBoundingSet=~CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_AUDIT_WRITE
-CapabilityBoundingSet=~CAP_KILL
-CapabilityBoundingSet=~CAP_NET_BIND_SERVICE CAP_NET_BROADCAST CAP_NET_RAW
-CapabilityBoundingSet=~CAP_SYSLOG
-CapabilityBoundingSet=~CAP_SYS_NICE CAP_SYS_RESOURCE
-CapabilityBoundingSet=~CAP_MAC_ADMIN CAP_MAC_OVERRIDE
-CapabilityBoundingSet=~CAP_SYS_BOOT
-CapabilityBoundingSet=~CAP_LINUX_IMMUTABLE
-CapabilityBoundingSet=~CAP_IPC_LOCK
-CapabilityBoundingSet=~CAP_SYS_CHROOT
-CapabilityBoundingSet=~CAP_BLOCK_SUSPEND
-CapabilityBoundingSet=~CAP_LEASE
-CapabilityBoundingSet=~CAP_SYS_PACCT
-CapabilityBoundingSet=~CAP_SYS_TTY_CONFIG
-CapabilityBoundingSet=~CAP_WAKE_ALARM
-LockPersonality=true
-MemoryDenyWriteExecute=true
+# Security hardening - balanced approach for Deno applications
 NoNewPrivileges=true
 PrivateDevices=true
 PrivateTmp=true
-PrivateUsers=true
-ProcSubset=pid
 ProtectControlGroups=true
-ProtectHome=tmpfs
 ProtectHostname=true
 ProtectKernelLogs=true
 ProtectKernelModules=true
 ProtectKernelTunables=true
-ProtectProc=invisible
 ProtectSystem=strict
-RemoveIPC=true
 RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
 RestrictNamespaces=true
 RestrictSUIDSGID=true
 RestrictRealtime=true
-SystemCallArchitectures=native
-SystemCallFilter=~@clock
-SystemCallFilter=~@debug
-SystemCallFilter=~@module
-SystemCallFilter=~@mount
-SystemCallFilter=~@raw-io
-SystemCallFilter=~@reboot
-SystemCallFilter=~@swap
-SystemCallFilter=~@privileged
-SystemCallFilter=~@resources
-SystemCallFilter=~@cpu-emulation
-SystemCallFilter=~@obsolete
 
+# Filesystem access
 BindReadOnlyPaths=/home/invidious/invidious-companion
 BindPaths=/home/invidious/tmp
 BindPaths=/var/tmp/youtubei.js
@@ -77,6 +35,7 @@ ExecStart=/home/invidious/invidious-companion/invidious_companion
 
 Environment=SERVER_USE_UNIX_SOCKET=true
 Environment=SERVER_UNIX_SOCKET_PATH=/home/invidious/tmp/invidious-companion.sock
+Environment=SERVER_SECRET_KEY=testkey123456789
 Environment=CACHE_DIRECTORY=/var/tmp/youtubei.js
 
 Restart=always