[Unit]
Description=HylaFAX+ faxgetty on %I
Documentation=man:faxgetty(8)
After=network.target
Before=faxq.service hfaxd.service

[Service]
Type=simple
ExecStart=/opt/hylafax/bin/faxgetty %I
SuccessExitStatus=255
TimeoutStopSec=5
Restart=always
RestartSec=10
StandardOutput=journal
StandardError=journal
SyslogIdentifier=faxgetty-%I

PrivateTmp=true
ProtectHome=tmpfs
ProtectSystem=strict
ProtectControlGroups=yes
ProtectKernelTunables=yes
ProtectKernelModules=yes
MemoryDenyWriteExecute=yes
RestrictNamespaces=yes
LockPersonality=yes
SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @raw-io @reboot @swap
SystemCallArchitectures=native
RestrictRealtime=no
PrivateDevices=no

ReadWritePaths=/run/hylafax
ReadWritePaths=/opt/hylafax/spool
ReadWritePaths=/var/spool

[Install]
WantedBy=multi-user.target