neini on Nostr: also recommended: AmbientCapabilities. For example, I use this configuration to run ...

also recommended: AmbientCapabilities. For example, I use this configuration to run backups, with a normal user that gets the "read all files capability":

User=backup
AmbientCapabilities=CAP_DAC_READ_SEARCH

The service also makes the system read-only for itself, apart from /var/lib/backup and a private /tmp:

ProtectSystem=strict
ReadWritePaths=/var/lib/backup
PrivateTmp=true

#systemd