[Unit]
Description=Syncthing over qrexec for Qubes
After=qubes-qrexec-agent.service
ConditionPathExists=/var/run/qubes-service/qubes-syncthing

[Service]
ExecStart=/usr/bin/socat TCP4-LISTEN:22001,reuseaddr,fork,end-close EXEC:"qrexec-client-vm syncthing qubes.Syncthing"
Restart=on-failur
RestartSec=3

# Hardening
ProtectSystem=full
PrivateTmp=true
SystemCallArchitectures=native
MemoryDenyWriteExecute=true
NoNewPrivileges=true

[Install]
WantedBy=multi-user.target