nixos/ympd: Unit hardening

    systemd.services.ympd = {

      description = "Standalone MPD Web GUI written in C";

      wantedBy = [ "multi-user.target" ];

      serviceConfig.ExecStart = "${pkgs.ympd}/bin/ympd --host ${cfg.mpd.host} --port ${toString cfg.mpd.port} --webport ${toString cfg.webPort} --user nobody";

      after = [ "network-online.target" ];

      serviceConfig = {

        ExecStart = ''

          ${pkgs.ympd}/bin/ympd \

            --host ${cfg.mpd.host} \

            --port ${toString cfg.mpd.port} \

            --webport ${toString cfg.webPort}

        '';

        DynamicUser = true;

        NoNewPrivileges = true;

        ProtectProc = "invisible";

        ProtectSystem = "strict";

        ProtectHome = "tmpfs";

        PrivateTmp = true;

        PrivateDevices = true;

        PrivateIPC = true;

        ProtectHostname = true;

        ProtectClock = true;

        ProtectKernelTunables = true;

        ProtectKernelModules = true;

        ProtectKernelLogs = true;

        ProtectControlGroups = true;

        RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];

        RestrictRealtime = true;

        RestrictSUIDSGID = true;

        SystemCallFilter = [

          "@system-service"

          "~@process"

          "~@setuid"

        ];

      };

    };

  };