[Unit] Description=kiss-ntpd NTP daemon After=network-online.target Wants=network-online.target StartLimitIntervalSec=0 Documentation=https://code.moparisthebest.com/moparisthebest/kiss-ntpd Documentation=https://github.com/moparisthebest/kiss-ntpd [Service] ExecStart=/usr/bin/kiss-ntpd Restart=always RestartSec=1s # anything under here isn't strictly needed, but probably good # to lock this down with the minimal permissions necessary # which are not many at all User=kiss-ntpd DynamicUser=yes ProtectSystem=strict ProtectHome=true PrivateTmp=true PrivateDevices=true ProtectHostname=true ProtectKernelTunables=true ProtectKernelModules=true ProtectKernelLogs=true ProtectControlGroups=true RestrictAddressFamilies=AF_INET AF_INET6 RestrictNamespaces=net LockPersonality=true MemoryDenyWriteExecute=true RestrictRealtime=true RestrictSUIDSGID=true RemoveIPC=true SystemCallArchitectures=native # these are just needed to bind to low ports CapabilityBoundingSet=CAP_NET_BIND_SERVICE AmbientCapabilities=CAP_NET_BIND_SERVICE [Install] WantedBy=multi-user.target