From 6e0814a84577c810bdc118c85eabe5d6d64cdffd Mon Sep 17 00:00:00 2001
From: Florian Preinstorfer <site-github@nblock.org>
Date: Mon, 22 Jun 2026 11:39:07 +0200
Subject: [PATCH] Add DevicePolicy and MemoryDenyWriteExecute

I've used those for a long time with my setups.
---
 packaging/systemd/headscale.service | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/packaging/systemd/headscale.service b/packaging/systemd/headscale.service
index 7f02c915..6881b290 100644
--- a/packaging/systemd/headscale.service
+++ b/packaging/systemd/headscale.service
@@ -16,7 +16,9 @@ ReadWritePaths=/var/lib/headscale
 
 AmbientCapabilities=CAP_NET_BIND_SERVICE
 CapabilityBoundingSet=CAP_NET_BIND_SERVICE
+DevicePolicy=closed
 LockPersonality=true
+MemoryDenyWriteExecute=true
 NoNewPrivileges=true
 PrivateDevices=true
 PrivateMounts=true