Comment by jamespo

take your pick: https://github.com/alegrey91/systemd-service-hardening - and this was 6 years ago and barely scratches the surface