[Unit]
Description=HylaFAX+ protocol server
Documentation=man:hfaxd(8)
After=network.target

[Service]
Type=simple
ExecStart=/opt/hylafax/bin/hfaxd -d -f IPv6 -i 4559
SuccessExitStatus=255
Restart=always
RestartSec=10
StandardOutput=journal
StandardError=journal
SyslogIdentifier=hfaxd

PrivateTmp=true
ProtectHome=tmpfs
ProtectSystem=strict
ProtectControlGroups=yes
ProtectKernelTunables=yes
ProtectKernelModules=yes
MemoryDenyWriteExecute=yes
RestrictNamespaces=yes
LockPersonality=yes
SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @obsolete @raw-io @reboot @swap
SystemCallArchitectures=native
RestrictRealtime=no
PrivateDevices=no

ReadWritePaths=/run/hylafax
ReadWritePaths=/opt/hylafax/spool
ReadWritePaths=/var/spool

[Install]
WantedBy=multi-user.target