From d063688422cb84a8e3b6997769068fc74eab87ad Mon Sep 17 00:00:00 2001
From: Robert Sprunk <git@sprunk.me>
Date: Mon, 9 Dec 2019 14:28:19 +0100
Subject: [PATCH] Move PrivateDevices to a separate section and add a comment

Signed-off-by: Robert Sprunk <git@sprunk.me>
---
 contrib/airsonic.service | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/contrib/airsonic.service b/contrib/airsonic.service
index 5cb0995d..13617ffa 100644
--- a/contrib/airsonic.service
+++ b/contrib/airsonic.service
@@ -26,7 +26,6 @@ Group=airsonic
 DevicePolicy=closed
 DeviceAllow=char-alsa rw
 NoNewPrivileges=yes
-#PrivateDevices=yes
 PrivateTmp=yes
 PrivateUsers=yes
 ProtectControlGroups=yes
@@ -38,6 +37,10 @@ RestrictRealtime=yes
 SystemCallFilter=~@clock @debug @module @mount @obsolete @privileged @reboot @setuid @swap
 ReadWritePaths=/var/airsonic
 
+# You can uncomment the following line if you're not using the jukebox
+# This will prevent airsonic from accessing any real (physical) devices
+#PrivateDevices=yes
+
 # You can change the following line to `strict` instead of `full`
 # if you don't want airsonic to be able to
 # write anything on your filesystem outside of AIRSONIC_HOME.