rdircd.service

[Unit]
StartLimitIntervalSec=2min
StartLimitBurst=5

[Service]
Type=exec
User=rdircd
WorkingDirectory=/var/lib/rdircd
ReadWritePaths=/var/lib/rdircd
ExecStart=rdircd -c config.ini -c state.ini
ExecReload=kill -HUP $MAINPID

Restart=always
RestartSec=5

DynamicUser=yes
ProcSubset=pid
ProtectProc=invisible
ProtectHome=yes
PrivateDevices=yes
PrivateUsers=yes
NoNewPrivileges=yes
SecureBits=noroot-locked
SystemCallFilter=@system-service
SystemCallArchitectures=native
RestrictAddressFamilies=AF_INET AF_INET6 AF_ALG

UMask=0077
LockPersonality=yes
MemoryDenyWriteExecute=yes
ProtectClock=yes
ProtectKernelLogs=yes
ProtectControlGroups=yes
ProtectKernelModules=yes
ProtectHostname=yes
ProtectKernelTunables=yes
RestrictRealtime=yes
RestrictNamespaces=yes
CapabilityBoundingSet=

[Install]
WantedBy=multi-user.target