[Unit]
Description=HylaFAX+ queue manager
Documentation=man:faxq(8)
After=network.target

[Service]
Type=simple
ExecStart=/opt/hylafax/bin/faxq -D
SuccessExitStatus=255
Restart=always
RestartSec=10
StandardOutput=journal
StandardError=journal
SyslogIdentifier=faxq

PrivateTmp=true
ProtectHome=tmpfs
ProtectSystem=strict
ProtectControlGroups=yes
ProtectKernelTunables=yes
ProtectKernelModules=yes
MemoryDenyWriteExecute=yes
RestrictNamespaces=yes
LockPersonality=yes
SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @raw-io @reboot @swap
SystemCallArchitectures=native
RestrictRealtime=no
PrivateDevices=no

ReadWritePaths=/run/hylafax
ReadWritePaths=/opt/hylafax/spool
ReadWritePaths=/var/spool

[Install]
WantedBy=multi-user.target