[Unit]
Description=HY2XS Hysteria2 server
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
User=hysteria
Group=hysteria
ExecStart=/usr/local/bin/hysteria server -c /etc/hysteria/config.yaml
Restart=on-failure
RestartSec=5s
AmbientCapabilities=CAP_NET_BIND_SERVICE
CapabilityBoundingSet=CAP_NET_BIND_SERVICE
NoNewPrivileges=true
PrivateTmp=true
ProtectHome=true
ProtectSystem=strict
ReadOnlyPaths=/etc/hysteria/config.yaml
ReadWritePaths=/var/lib/hysteria
RestrictAddressFamilies=AF_INET AF_UNIX
SystemCallArchitectures=native
LockPersonality=true

[Install]
WantedBy=multi-user.target