snotify.service

[Unit]
Description=Audible Notifications
After=dbus.service
Requires=pipewire.service

[Service]
ExecStart=/usr/bin/snotify
Restart=always
RestartSec=1s
MemoryHigh=16M
MemoryMax=30M
OOMPolicy=kill

#CPUQuota=1%
CPUWeight=50

CapabilityBoundingSet=
AmbientCapabilities=

ProtectSystem=strict
ProtectHome=read-only
PrivateTmp=yes
PrivateDevices=yes
ProtectHostname=yes
ProtectClock=yes
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectKernelLogs=yes
ProtectControlGroups=yes
RestrictNamespaces=yes
LockPersonality=yes
MemoryDenyWriteExecute=yes
RestrictRealtime=yes
RestrictSUIDSGID=yes
RemoveIPC=yes
SystemCallArchitectures=native
UMask=077
NoNewPrivileges=yes
KeyringMode=private
ProtectProc=invisible
ProcSubset=pid

SystemCallFilter=~@reboot
SystemCallFilter=~@raw-io
SystemCallFilter=~@privileged
SystemCallFilter=~@mount
SystemCallFilter=~@module
SystemCallFilter=~@debug
SystemCallFilter=~@cpu-emulation
SystemCallFilter=~@obsolete
#SystemCallFilter=~@resources
#RestrictAddressFamilies=none
RestrictAddressFamilies=AF_UNIX
IPAccounting=yes
IPAddressAllow=localhost
PrivateUsers=yes
PrivateNetwork=yes

[Install]
WantedBy=default.target