[Unit]
Description=HylaFAX+ fax cron
Documentation=man:faxcron(8)
ConditionFileNotEmpty=/opt/hylafax/spool/log/xferfaxlog

[Service]
Type=oneshot
ExecStart=/opt/hylafax/bin/faxcron -info 90 -log 90 -rcv 90 -tmp 90
StandardOutput=journal
StandardError=journal
SyslogIdentifier=faxcron

PrivateTmp=true
ProtectHome=tmpfs
ProtectSystem=strict
ProtectControlGroups=yes
ProtectKernelTunables=yes
ProtectKernelModules=yes
MemoryDenyWriteExecute=yes
RestrictNamespaces=yes
LockPersonality=yes
SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @raw-io @reboot @swap
SystemCallArchitectures=native
RestrictRealtime=yes
PrivateDevices=yes

CPUSchedulingPolicy=idle
IOSchedulingClass=idle
IOSchedulingPriority=7

User=hylafax
Group=hylafax

ReadWritePaths=/run/hylafax
ReadWritePaths=/opt/hylafax/spool
ReadWritePaths=/var/spool