[Unit]
Description=nxdns DNS sinkhole
Documentation=https://git.mial.net/mokhtar/nxdns
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
User=nxdns
Group=nxdns
ExecStart=/usr/local/bin/nxdns run

# nxdns logs to stderr by default; systemd captures it into the journal.
StateDirectory=nxdns
StateDirectoryMode=0700
LogsDirectory=nxdns
ConfigurationDirectory=nxdns

# Port 53 (and 443/853 when the DoH/DoT listeners are enabled).
AmbientCapabilities=CAP_NET_BIND_SERVICE
CapabilityBoundingSet=CAP_NET_BIND_SERVICE

NoNewPrivileges=yes
ProtectSystem=strict
ProtectHome=yes
PrivateTmp=yes
PrivateDevices=yes
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectKernelLogs=yes
ProtectControlGroups=yes
ProtectClock=yes
ProtectHostname=yes
ProtectProc=invisible
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
RestrictNamespaces=yes
RestrictRealtime=yes
RestrictSUIDSGID=yes
LockPersonality=yes
MemoryDenyWriteExecute=yes
UMask=0077
SystemCallFilter=@system-service
SystemCallArchitectures=native

Restart=on-failure
RestartSec=2

[Install]
WantedBy=multi-user.target