[Unit]
Description=nxdns DNS sinkhole
Documentation=https://git.mial.net/mokhtar/nxdns
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
User=nxdns
Group=nxdns
ExecStart=/usr/local/bin/nxdns run

# nxdns logs to stderr by default; systemd captures it into the journal.
StateDirectory=nxdns
StateDirectoryMode=0700
LogsDirectory=nxdns
ConfigurationDirectory=nxdns

# ConfigurationDirectory creates /etc/nxdns owned by the service user. nxdns
# never writes there in either authority mode, and in file mode that directory
# holds the source of truth, so deny the write outright rather than rely on it.
ReadOnlyPaths=/etc/nxdns

# Port 53 (and 443/853 when the DoH/DoT listeners are enabled).
AmbientCapabilities=CAP_NET_BIND_SERVICE
CapabilityBoundingSet=CAP_NET_BIND_SERVICE

NoNewPrivileges=yes
ProtectSystem=strict
ProtectHome=yes
PrivateTmp=yes
PrivateDevices=yes
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectKernelLogs=yes
ProtectControlGroups=yes
ProtectClock=yes
ProtectHostname=yes
ProtectProc=invisible
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
RestrictNamespaces=yes
RestrictRealtime=yes
RestrictSUIDSGID=yes
LockPersonality=yes
MemoryDenyWriteExecute=yes
UMask=0077
SystemCallFilter=@system-service
SystemCallArchitectures=native

Restart=on-failure
RestartSec=2
# Exit 2 is a configuration fault and 64 is a usage error. Neither clears on a
# retry, so a restart loop only buries the diagnostics already in the journal.
RestartPreventExitStatus=2 64

[Install]
WantedBy=multi-user.target