livemon.service

[Service]
ExecStart=/usr/bin/livemon daemon --addr=[::]:9843 --unix=/run/livemon/livemon.sock
StateDirectory=livemon
StateDirectoryMode=0700
RuntimeDirectory=livemon
RuntimeDirectoryMode=0700
Restart=on-failure
ProtectProc=invisible
ProcSubset=pid
DynamicUser=true
CapabilityBoundingSet=
AmbientCapabilities=
NoNewPrivileges=true
SecureBits=no-setuid-fixup no-setuid-fixup-locked noroot noroot-locked
KeyringMode=private
ProtectSystem=strict
ProtectHome=true
PrivateTmp=true
PrivateDevices=true
PrivateIPC=true
PrivateUsers=true
ProtectHostname=true
ProtectClock=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectKernelLogs=true
ProtectControlGroups=true
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
RestrictNamespaces=true
LockPersonality=true
MemoryDenyWriteExecute=true
RestrictRealtime=true
RestrictSUIDSGID=true
RemoveIPC=true
PrivateMounts=true
SystemCallFilter=@system-service
SystemCallArchitectures=native

[Install]
WantedBy=multi-user.target