[Service]
ExecStart=/usr/local/sbin/mirror-health
RuntimeDirectory=dsa-mirror-health-<%= @healthcheck_service %>
-DynamicUser=true
+ProtectSystem=full
+ProtectHome=read-only
+PrivateTmp=true
+User=nobody
+Group=nogroup
Environment="MIRROR_CHECK_SERVICE=<%= @check_service %>"
Environment="MIRROR_CHECK_URL=<%= @url %>"