[Unit] Description=mautrix-whatsapp bridge [Service] Type=exec User=mautrix-signal-bin WorkingDirectory=/opt/mautrix-signal ExecStart=/opt/mautrix-signal/mautrix-signal Restart=on-failure RestartSec=30s # Optional hardening to improve security ReadWritePaths=/opt/mautrix-signal NoNewPrivileges=yes MemoryDenyWriteExecute=true PrivateDevices=yes PrivateTmp=yes ProtectHome=yes ProtectSystem=strict ProtectControlGroups=true RestrictSUIDSGID=true RestrictRealtime=true LockPersonality=true ProtectKernelLogs=true ProtectKernelTunables=true ProtectHostname=true ProtectKernelModules=true PrivateUsers=true ProtectClock=true SystemCallArchitectures=native SystemCallErrorNumber=EPERM SystemCallFilter=@system-service [Install] WantedBy=multi-user.target