[Unit]
Description=DNS SRV lookup of %I for chrony
After=chrony.service network-online.target
Wants=network-online.target

[Service]
Type=oneshot
ExecStart=/usr/libexec/chrony/chrony-helper update-dnssrv-servers %I
ProtectSystem=strict
PrivateDevices=yes
ProtectHome=yes
ReadWritePaths=/run
PrivateTmp=yes
PrivateDevices=yes
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectControlGroups=yes