dnscrypt-proxy.service file (hardened, requiring systemd-sockets)

dnscrypt-proxy.service.hardened

[Unit]
Description=DNSCrypt client proxy
Documentation=https://github.com/DNSCrypt/dnscrypt-proxy/wiki
Requires=dnscrypt-proxy.socket
After=network.target
Before=nss-lookup.target
Wants=nss-lookup.target

[Install]
Also=dnscrypt-proxy.socket
WantedBy=multi-user.target

[Service]
# Use type=notify service as dnscrypt-proxy already does the signaling.
Type=notify
NonBlocking=true
ExecStart=/usr/sbin/dnscrypt-proxy -config /etc/dnscrypt-proxy/dnscrypt-proxy.toml
#ExecStart=/opt/dnscrypt-proxy -config /etc/dnscrypt-proxy/dnscrypt-proxy.toml
CapabilityBoundingSet=
DevicePolicy=strict
DeviceAllow=/dev/stdin
LockPersonality=true
MemoryDenyWriteExecute=true
NoNewPrivileges=true
PrivateNetwork=false
PrivateUsers=true
PrivateDevices=true
PrivateTmp=true
ProtectClock=true
ProtectSystem=strict
ProtectHome=true
ProtectHostname=true
ProtectKernelLogs=true
ProtectKernelModules=true
ProtectKernelTunables=true
ProtectControlGroups=true
ProtectProc=noaccess
ProcSubset=pid
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
RestrictSUIDSGID=true
RestrictNamespaces=true
RestrictRealtime=true
RemoveIPC=true
SystemCallArchitectures=native
SystemCallFilter=~@privileged @debug @mount @cpu-emulation @obsolete @resources

User=_dnscrypt-proxy
UMask=0177
CacheDirectory=dnscrypt-proxy
LogsDirectory=dnscrypt-proxy
RuntimeDirectory=dnscrypt-proxy