···

       
69
       
69
       
 
       
        ExecStart = "${lib.getExe cfg.package} serve -config ${configFile}";

     

       
70
       
70
       
 
       
        ProtectSystem = "full";

     

       
71
       
71
       
 
       
        SystemCallArchitectures = "native";

     

       
72
       
72
       
+
       
        MemoryDenyWriteExecute = true;

     

       
72
       
73
       
 
       
        NoNewPrivileges = true;

     

       
73
       
74
       
 
       
        PrivateTmp = true;

     

       
74
       
75
       
 
       
        PrivateDevices = true;