[Service]
ExecStart=@rootlibexecdir@/systemd-journal-upload \
--save-state
+SecureBits=noroot noroot-locked
User=systemd-journal-upload
PrivateTmp=yes
PrivateDevices=yes
WatchdogSec=20min
+# If there are many split up journal files we need a lot of fds to
+# access them all and combine
+LimitNOFILE=16384
+
[Install]
WantedBy=multi-user.target