1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20

[Unit]
Description=Capability Token Service
Documentation=man:capability-token-service(1)
After=network.target

[Service]
Type=simple
ExecStart=%h/.nix-profile/bin/capability-token-service
Restart=on-failure
RestartSec=5s

# Security hardening
NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=strict
ProtectHome=read-only
ReadWritePaths=%h/.config/capability-tokens %t

[Install]
WantedBy=default.target