Harden sync server transport and credentials

verstak-server.service

@@ -7,16 +7,20 @@ Type=simple
 User=verstak
 Group=verstak
 WorkingDirectory=/opt/verstak-sync-server
-Environment=VERSTAK_PORT=47732
 EnvironmentFile=-/etc/verstak-server/env
-ExecStart=/opt/verstak-sync-server/verstak-sync-server --port ${VERSTAK_PORT} --data /var/lib/verstak-sync-server
+ExecStart=/opt/verstak-sync-server/verstak-sync-server --data /var/lib/verstak-sync-server
 Restart=on-failure
 RestartSec=5
-AmbientCapabilities=CAP_NET_BIND_SERVICE
 NoNewPrivileges=true
-ProtectSystem=full
+ProtectSystem=strict
 ProtectHome=true
 PrivateTmp=true
+ProtectKernelTunables=true
+ProtectControlGroups=true
+ProtectKernelModules=true
+LockPersonality=true
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+ReadWritePaths=/var/lib/verstak-sync-server
 StateDirectory=verstak-sync-server
 RuntimeDirectory=verstak-sync-server