[Unit] Description=service mautrix-syncproxy Documentation=https://github.com/mautrix/syncproxy After=network.target [Service] User=mautrix-syncproxy Group=mautrix-syncproxy EnvironmentFile=/etc/default/mautrix-syncproxy ExecStart=/usr/bin/mautrix-syncproxy WorkingDirectory=/var/lib/mautrix-syncproxy Restart=on-failure RestartSec=30s ReadWritePaths=/var/lib/mautrix-syncproxy NoNewPrivileges=yes MemoryDenyWriteExecute=true PrivateDevices=yes PrivateTmp=yes ProtectHome=yes ProtectSystem=strict ProtectControlGroups=true RestrictSUIDSGID=true RestrictRealtime=true LockPersonality=true ProtectKernelLogs=true ProtectKernelTunables=true ProtectHostname=true ProtectKernelModules=true PrivateUsers=true ProtectClock=true SystemCallArchitectures=native SystemCallErrorNumber=EPERM SystemCallFilter=@system-service [Install] WantedBy=multi-user.target
source : https://www.freedesktop.org/software/systemd/man/systemd.service.html