switch systemd service to notify and add system protection directives

debian/nsd.service

@@ -4,10 +4,21 @@ Documentation=man:nsd(8)
 After=network.target
 
 [Service]
-Type=simple
+Type=notify
 Restart=always
 ExecStart=/usr/sbin/nsd -d
-ExecReload=/usr/sbin/nsd-control reload
+ExecReload=/bin/kill -HUP $MAINPID
+CapabilityBoundingSet=CAP_IPC_LOCK CAP_NET_BIND_SERVICE CAP_SETGID CAP_SETUID CAP_SYS_CHROOT
+MemoryDenyWriteExecute=true
+NoNewPrivileges=true
+PrivateDevices=true
+PrivateTmp=true
+ProtectHome=true
+ProtectControlGroups=true
+ProtectKernelModules=true
+ProtectKernelTunables=true
+ProtectSystem=strict
+
 
 [Install]
 WantedBy=multi-user.target