[Unit]
Description=HylaFAX+ fax queue cleaner
Documentation=man:faxqclean(8)

[Service]
Type=oneshot
ExecStart=/opt/hylafax/bin/faxqclean -a -A -j 86400 -d 86400 -v
StandardOutput=journal
StandardError=journal
SyslogIdentifier=faxqclean

PrivateTmp=true
ProtectHome=tmpfs
ProtectSystem=strict
ProtectControlGroups=yes
ProtectKernelTunables=yes
ProtectKernelModules=yes
MemoryDenyWriteExecute=yes
RestrictNamespaces=yes
LockPersonality=yes
SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @raw-io @reboot @swap
SystemCallArchitectures=native
RestrictRealtime=yes
PrivateDevices=yes

CPUSchedulingPolicy=idle
IOSchedulingClass=idle
IOSchedulingPriority=7

ReadWritePaths=/run/hylafax
ReadWritePaths=/opt/hylafax/spool
ReadWritePaths=/var/spool