{ lib, config, ... }:
{
  config.systemd.services = lib.mkIf (config.specialisation != { }) {
    acpid.serviceConfig = {
      CapabilityBoundingSet = [
       ""
       ];
      NoNewPrivileges = true;
      RestrictNamespaces = "pid";
      ProtectControlGroups = true;
      ProtectKernelModules = true;
      ProtectKernelTunables = true;
      MemoryDenyWriteExecute = true;
      RestrictSUIDSGID = true;
      SystemCallArchitectures = "native";
      SystemCallFilter = "@system-service";
      LockPersonality = true;
      ProtectHostname=true;
      ProtectSystem=true;
      PrivateUsers=true;
      PrivateNetwork=true;
      RestrictRealtime=true;
      IPAddressAllow=[];
      RestrictAddressFamilies="AF_NETLINK AF_UNIX";
    };
  };
}