[Unit]
Description=Gromox snapshot job
Documentation=man:gromox-snapshot(8)
ConditionPathIsDirectory=/var/lib/gromox/user

[Service]
Type=oneshot
ExecStart=/usr/local/libexec/gromox/gromox-snapshot
PrivateDevices=yes
PrivateNetwork=yes
PrivateUsers=no
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectControlGroups=yes
MemoryDenyWriteExecute=yes
SystemCallFilter=@default @file-system @basic-io @system-service
