62 lines
2.4 KiB
Desktop File
62 lines
2.4 KiB
Desktop File
# Managed by pi-dictate install.sh
|
|
[Unit]
|
|
Description=Pi dictation transcription service
|
|
Requires=pi-dictate.socket
|
|
After=pipewire.service
|
|
|
|
[Service]
|
|
Type=simple
|
|
TimeoutStopSec=5s
|
|
ExecStart=%h/.local/share/pi-dictate/venv/bin/pi-dictate-service
|
|
Environment=PI_DICTATE_CONFIG_PATH=%h/.config/pi-dictate/config.json
|
|
Environment=PI_DICTATE_DEPENDENCY_PROFILE_PATH=%h/.local/share/pi-dictate/.dependency-profile
|
|
# local/offline is the fail-closed base. The installer-owned cloud drop-in
|
|
# replaces these values only after a cloud configuration and dependency profile
|
|
# have been installed.
|
|
Environment=PI_DICTATE_NETWORK_MODE=offline
|
|
Environment=PI_DICTATE_MODEL_PATH=%h/.local/share/pi-dictate/models/parakeet-tdt-0.6b-v3/parakeet-tdt-0.6b-v3.nemo
|
|
Environment=PI_DICTATE_TERMS_PATH=%h/.local/share/pi-dictate/config/coding-terms.txt
|
|
Environment=PI_DICTATE_BOOST_ALPHA=1.0
|
|
Environment=PI_DICTATE_IDLE_SECONDS=900
|
|
Environment=HF_HUB_OFFLINE=1
|
|
Environment=TRANSFORMERS_OFFLINE=1
|
|
Environment=NEMO_HOME=/tmp/pi-dictate-nemo
|
|
Environment=HF_HOME=/tmp/pi-dictate-huggingface
|
|
Environment=TRITON_CACHE_DIR=/tmp/pi-dictate-triton
|
|
Environment=NUMBA_CACHE_DIR=/tmp/pi-dictate-numba
|
|
Environment=PYTHONDONTWRITEBYTECODE=1
|
|
# Never inherit ambient proxy credentials or route audio through an unreviewed proxy.
|
|
Environment=HTTP_PROXY=
|
|
Environment=HTTPS_PROXY=
|
|
Environment=ALL_PROXY=
|
|
Environment=http_proxy=
|
|
Environment=https_proxy=
|
|
Environment=all_proxy=
|
|
UMask=0077
|
|
LimitCORE=0
|
|
MemorySwapMax=0
|
|
NoNewPrivileges=yes
|
|
PrivateTmp=yes
|
|
ProtectClock=yes
|
|
ProtectControlGroups=yes
|
|
ProtectKernelLogs=yes
|
|
ProtectKernelModules=yes
|
|
ProtectKernelTunables=yes
|
|
ProtectSystem=strict
|
|
ProtectHome=tmpfs
|
|
BindReadOnlyPaths=%h/.local/share/pi-dictate
|
|
BindReadOnlyPaths=%h/.local/share/uv/python
|
|
BindReadOnlyPaths=%h/.config/pi-dictate/config.json
|
|
BindReadOnlyPaths=%h/.config/systemd/user/pi-dictate.service
|
|
BindReadOnlyPaths=%h/.config/systemd/user/pi-dictate.service.d
|
|
BindReadOnlyPaths=%h/.config/systemd/user/pi-dictate.socket
|
|
BindReadOnlyPaths=%t/pipewire-0
|
|
RestrictAddressFamilies=AF_UNIX
|
|
SystemCallFilter=~bind listen
|
|
IPAddressDeny=any
|
|
LockPersonality=yes
|
|
# Refuse a service/config/dependency/network-mode or hardening mismatch before runtime code starts.
|
|
ExecStartPre=%h/.local/share/pi-dictate/venv/bin/python -c 'from pi_dictate_service.startup import validate_startup; validate_startup()'
|
|
|
|
# The socket unit owns %t/pi-dictate.sock. The service must not unlink it.
|