rsync@.service

[Unit]
Description=fast remote file copy program daemon
After=network.target

[Service]
ExecStart=-/usr/bin/rsync --daemon
StandardInput=socket
StandardOutput=inherit
StandardError=journal

# Citing README.md:
#
#   [...] Using ssh is recommended for its security features.
#
#   Alternatively, rsync can run in `daemon' mode, listening on a socket.
#   This is generally used for public file distribution, [...]
#
# So let's assume some extra security is more than welcome here. We do full
# system protection (which makes /usr, /boot, & /etc read-only) and hide
# devices. To override these defaults, it's best to do so in the drop-in
# directory, often done via `systemctl edit rsync@.service`. The file needs
# just the bare minimum of the right [heading] and override values.
# See systemd.unit(5) and search for "drop-in" for full details.

ProtectSystem=full
#ProtectHome=on|off|read-only

# These are general hardening parameters that should not affect file access
PrivateDevices=on
NoNewPrivileges=on
MemoryDenyWriteExecute=on
LockPersonality=on
PrivateTmp=on
ProtectClock=on
ProtectControlGroups=on
ProtectHostname=on
ProtectKernelLogs=on
ProtectKernelModules=on
ProtectKernelTunables=on
ProtectProc=invisible
ProcSubset=pid
RestrictNamespaces=on
RestrictRealtime=on
SystemCallArchitectures=native
SystemCallErrorNumber=EPERM
SystemCallFilter=@system-service

# These settings work only for inetd-style activation
RestrictAddressFamilies=AF_UNIX
PrivateNetwork=on
IPAddressDeny=any