[Unit]
Description=Roentgen-owned system Xray process
Requires=roentgen-guard.service
After=roentgen-guard.service

[Service]
Type=simple
User=roentgen-xray
Group=roentgen-xray
ExecStart=/usr/bin/xray run -config /run/roentgen/xray.json
Restart=on-failure
RestartSec=5
AmbientCapabilities=CAP_NET_ADMIN CAP_NET_RAW
CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_RAW
NoNewPrivileges=yes
PrivateTmp=yes
ProtectHome=yes
ProtectSystem=strict
UMask=0077