Update init examples

init/systemd/system/odidere@.service

@@ -1,22 +1,33 @@
 [Unit]
 Description=odidere
-After=network.target whisper.service kokoro.service
-Requires=whisper.service kokoro.service
+After=network.target
 
 [Service]
 User=%i
 ExecStart=/usr/local/bin/odidere -c /etc/odidere/config.yaml
 Restart=on-failure
-RestartSec=10
 
-ProtectSystem=full
-PrivateTmp=true
-SystemCallArchitectures=native
-MemoryDenyWriteExecute=true
-NoNewPrivileges=true
+# Makes /usr, /boot, /efi, and /etc read-only for the service and its tools.
+# ProtectSystem=full
 
-StartLimitIntervalSec=60
-StartLimitBurst=4
+# Gives the service and its tools private /tmp and /var/tmp directories.
+# Files in those directories are not shared with other services.
+# PrivateTmp=true
+
+# These optional restrictions also apply to tool subprocesses.
+# https://www.freedesktop.org/software/systemd/man/latest/systemd.exec.html
+
+# Restricts system calls to the native architecture. Tools that execute
+# binaries for another ABI, such as 32-bit binaries, can fail.
+# SystemCallArchitectures=native
+
+# Blocks writable executable memory. Tool runtimes that generate machine
+# code can fail under this restriction.
+# MemoryDenyWriteExecute=true
+
+# Prevents privilege gains through setuid executables or file capabilities.
+# Tools that rely on those privilege gains can fail.
+# NoNewPrivileges=true
 
 [Install]
 WantedBy=multi-user.target

init/systemd/user/odidere.service

@@ -1,19 +1,25 @@
 [Unit]
 Description=odidere
-After=network.target whisper.service kokoro.service
-Requires=whisper.service kokoro.service
+After=network.target
 
 [Service]
 ExecStart=%h/.local/bin/odidere -c %h/.config/odidere/config.yaml
 Restart=on-failure
-RestartSec=10
 
-SystemCallArchitectures=native
-MemoryDenyWriteExecute=true
-NoNewPrivileges=true
+# These optional restrictions also apply to tool subprocesses.
+# https://www.freedesktop.org/software/systemd/man/latest/systemd.exec.html
 
-StartLimitIntervalSec=60
-StartLimitBurst=4
+# Restricts system calls to the native architecture. Tools that execute
+# binaries for another ABI, such as 32-bit binaries, can fail.
+# SystemCallArchitectures=native
+
+# Blocks writable executable memory. Tool runtimes that generate machine
+# code can fail under this restriction.
+# MemoryDenyWriteExecute=true
+
+# Prevents privilege gains through setuid executables or file capabilities.
+# Tools that rely on those privilege gains can fail.
+# NoNewPrivileges=true
 
 [Install]
 WantedBy=default.target