[Unit] Description=firepup's python-talk [Service] WorkingDirectory=%h/python-talk ExecStart=/usr/bin/python3 server.py --link=37.27.51.34:65048 --no-logs --no-cache --cwlgd Restart=always RestartSec=5 NoNewPrivileges=true RestrictSUIDSGID=true ProtectSystem=strict ProtectHome=tmpfs BindReadOnlyPaths=%h/python-talk ProtectProc=ptraceable ProcSubset=pid PrivateTmp=true CapabilityBoundingSet= PrivateDevices=true ProtectClock=true ProtectKernelLogs=true ProtectControlGroups=true ProtectKernelModules=true SystemCallArchitectures=native # python. MemoryDenyWriteExecute=false RestrictNamespaces=true ProtectHostname=true LockPersonality=true ProtectKernelTunables=true RestrictAddressFamilies=AF_INET RestrictRealtime=true PrivateUsers=true SystemCallFilter=@system-service SystemCallFilter=~@privileged @resources UMask=0077 [Install] WantedBy=default.target