diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..a5b61c0
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,13 @@
+# Local in-tree build results would break the build inside the container.
+# .git is kept on purpose: CMake uses it to embed the version.
+build/
+out/
+CMakeCache.txt
+CMakeFiles/
+Makefile
+cmake_install.cmake
+CTestTestfile.cmake
+Testing/
+custom_curl/
+/https_dns_proxy
+*_unittest
diff --git a/.github/workflows/portable-release.yml b/.github/workflows/portable-release.yml
new file mode 100644
index 0000000..c855760
--- /dev/null
+++ b/.github/workflows/portable-release.yml
@@ -0,0 +1,245 @@
+name: Portable release
+
+# Daily: builds the static (portable) binary and a Docker image, but only if the
+# source changed since the last release. The release tag is the build date (YYYY.MM.DD).
+on:
+  schedule:
+    - cron: '17 3 * * *'
+  workflow_dispatch:
+    inputs:
+      force:
+        description: Release even if nothing changed since the last release
+        type: boolean
+        default: false
+
+# Actions are pinned by commit hash, not by tag (the version is in the comment).
+# Tags like @v6 are mutable: if an action's repository is compromised, the tag can be
+# moved to malicious code, as happened with tj-actions/changed-files in 2025. This
+# workflow can write releases and packages, so it runs only reviewed, fixed code.
+# To update an action: git ls-remote https://github.com/<owner>/<action> 'refs/tags/<tag>^{}'
+permissions:
+  contents: write
+  packages: write
+
+concurrency:
+  group: portable-release
+  cancel-in-progress: false
+
+jobs:
+  check:
+    # Scheduled runs always use the default branch; this also stops manual runs on other
+    # branches, so only merged code is released
+    if: >-
+      github.event_name == 'schedule' ||
+      github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
+    runs-on: ubuntu-latest
+    outputs:
+      changed: ${{ steps.check.outputs.changed }}
+      version: ${{ steps.check.outputs.version }}
+    steps:
+    - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+      with:
+        fetch-depth: 0
+
+    - name: Check for changes since the last release
+      id: check
+      env:
+        GH_TOKEN: ${{ github.token }}
+        FORCE: ${{ inputs.force }}
+      run: |
+        # Only these paths affect the binary or the release assets
+        watched_paths=(src CMakeLists.txt portable .dockerignore)
+
+        last_tag=$(gh release view --json tagName --jq .tagName 2>/dev/null || true)
+        if [ -z "$last_tag" ]; then
+          echo "No previous release"
+          changed=true
+        elif ! git diff --quiet "$last_tag" HEAD -- "${watched_paths[@]}"; then
+          echo "Changes since $last_tag:"
+          git log --oneline "$last_tag"..HEAD -- "${watched_paths[@]}"
+          changed=true
+        else
+          echo "No changes since $last_tag"
+          changed=false
+        fi
+        if [ "$FORCE" = "true" ]; then
+          changed=true
+        fi
+
+        # One release per day; a forced second run on the same day gets a suffix
+        version=$(date -u +%Y.%m.%d)
+        candidate=$version
+        n=1
+        while git rev-parse -q --verify "refs/tags/$candidate" >/dev/null; do
+          n=$((n + 1))
+          candidate="$version.$n"
+        done
+
+        echo "changed=$changed" >> "$GITHUB_OUTPUT"
+        echo "version=$candidate" >> "$GITHUB_OUTPUT"
+
+  release:
+    needs: check
+    if: needs.check.outputs.changed == 'true'
+    runs-on: ubuntu-latest
+    env:
+      VERSION: ${{ needs.check.outputs.version }}
+    steps:
+    - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+
+    - name: Set image name
+      run: echo "IMAGE=ghcr.io/${GITHUB_REPOSITORY,,}" >> "$GITHUB_ENV"
+
+    - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
+
+    - uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
+      with:
+        registry: ghcr.io
+        username: ${{ github.actor }}
+        password: ${{ github.token }}
+
+    - name: Build portable binary
+      uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
+      with:
+        context: .
+        file: portable/Dockerfile
+        target: binary
+        # All temporary files go outside the workspace: a new file in the workspace changes
+        # the build context, and the image build below would compile the binary again
+        # (with a different build time) instead of reusing this one
+        outputs: type=local,dest=${{ runner.temp }}/out
+        cache-from: type=gha
+        cache-to: type=gha,mode=max
+
+    - name: Smoke test
+      working-directory: ${{ runner.temp }}
+      run: |
+        file out/https_dns_proxy
+        file out/https_dns_proxy | grep -q 'static'
+        out/https_dns_proxy -V | tee versions.txt
+        grep -q HTTP3 versions.txt
+
+    # Unit tests already ran inside the Docker build. These tests need network access,
+    # dig, valgrind and Robot Framework, so they run here against the built binary.
+    - name: Install test dependencies
+      run: |
+        sudo apt-get update
+        sudo apt-get install -y --no-install-recommends dnsutils valgrind
+        python3 -m venv "$RUNNER_TEMP/venv"
+        "$RUNNER_TEMP/venv/bin/pip" install robotframework
+
+    - name: Integration tests
+      run: |
+        python3 tests/integration/test_tcp_lifecycle.py \
+          --binary "$RUNNER_TEMP/out/https_dns_proxy" --openssl "$(command -v openssl)"
+
+    # Robot and valgrind write logs into the current directory, so the tests run from a
+    # copy outside the workspace (a changed workspace would change the build context)
+    - name: Functional tests
+      run: |
+        cp -r tests/robot "$RUNNER_TEMP/robot"
+        cd "$RUNNER_TEMP/robot"
+        "$RUNNER_TEMP/venv/bin/python3" -m robot.run \
+          --variable "BINARY_PATH:$RUNNER_TEMP/out/https_dns_proxy" \
+          --outputdir "$RUNNER_TEMP/robot-results" \
+          functional_tests.robot
+
+    - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+      if: failure()
+      with:
+        name: functional-test-logs
+        path: |
+          ${{ runner.temp }}/robot-results
+          ${{ runner.temp }}/robot/valgrind-*.log
+
+    - name: Build and push Docker image
+      uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
+      with:
+        context: .
+        file: portable/Dockerfile
+        target: image
+        push: true
+        # "latest" is added only after the image passes the checks below
+        tags: ${{ env.IMAGE }}:${{ env.VERSION }}
+        labels: |
+          org.opencontainers.image.source=${{ github.server_url }}/${{ github.repository }}
+          org.opencontainers.image.revision=${{ github.sha }}
+          org.opencontainers.image.version=${{ env.VERSION }}
+          org.opencontainers.image.description=Static https_dns_proxy (DNS-over-HTTPS proxy with HTTP/3) on an empty base image
+        cache-from: type=gha
+
+    - name: Check that the image has the same binary
+      working-directory: ${{ runner.temp }}
+      run: |
+        docker pull "$IMAGE:$VERSION"
+        container=$(docker create "$IMAGE:$VERSION")
+        docker cp "$container:/https_dns_proxy" image_binary
+        docker rm "$container"
+        cmp out/https_dns_proxy image_binary
+
+    # The resolver is given by hostname, so this also checks the bundled CA certificates
+    # and /etc/services, which only the image provides
+    - name: Image test
+      run: |
+        docker run -d --name image_test -p 127.0.0.1:5053:5053/udp -p 127.0.0.1:5053:5053/tcp \
+          "$IMAGE:$VERSION" -4 -v -v -v -r https://cloudflare-dns.com/dns-query
+        sleep 3
+        status=0
+        dig +tries=3 +time=5 @127.0.0.1 -p 5053 example.com | grep -q 'status: NOERROR' || status=1
+        dig +tcp +tries=3 +time=5 @127.0.0.1 -p 5053 example.com | grep -q 'status: NOERROR' || status=1
+        docker logs image_test
+        docker rm -f image_test
+        exit "$status"
+
+    # -q allows only HTTP/3, so a successful answer means QUIC works in the image.
+    # "using HTTP/3" is logged by curl once the connection really uses HTTP/3.
+    - name: Image test (HTTP/3 only)
+      run: |
+        docker run -d --name image_test_http3 -p 127.0.0.1:5053:5053/udp -p 127.0.0.1:5053:5053/tcp \
+          "$IMAGE:$VERSION" -4 -q -v -v -v -r https://cloudflare-dns.com/dns-query
+        sleep 3
+        status=0
+        dig +tries=3 +time=5 @127.0.0.1 -p 5053 example.com | grep -q 'status: NOERROR' || status=1
+        dig +tcp +tries=3 +time=5 @127.0.0.1 -p 5053 example.com | grep -q 'status: NOERROR' || status=1
+        docker logs image_test_http3 > "$RUNNER_TEMP/image_test_http3.log" 2>&1
+        docker rm -f image_test_http3
+        grep -q 'using HTTP/3' "$RUNNER_TEMP/image_test_http3.log" || status=1
+        if [ "$status" -ne 0 ]; then
+          cat "$RUNNER_TEMP/image_test_http3.log"
+        fi
+        exit "$status"
+
+    - name: Tag image as latest
+      # Copies the tag in the registry, keeping the same digest and attestations
+      run: docker buildx imagetools create --tag "$IMAGE:latest" "$IMAGE:$VERSION"
+
+    - name: Prepare release assets
+      working-directory: ${{ runner.temp }}
+      run: |
+        mkdir dist
+        cp out/https_dns_proxy dist/https_dns_proxy-linux-amd64
+        cp "$GITHUB_WORKSPACE/portable/https_dns_proxy.service" dist/
+        cd dist && sha256sum -- * > SHA256SUMS
+
+    - name: Create release
+      working-directory: ${{ runner.temp }}
+      env:
+        GH_TOKEN: ${{ github.token }}
+      run: |
+        {
+          echo "Portable (statically linked) build of https_dns_proxy for Linux x86_64."
+          echo
+          echo '```'
+          cat versions.txt
+          echo '```'
+          echo
+          echo "Docker image: \`docker pull $IMAGE:$VERSION\`"
+          echo
+          echo "See the README section \"Portable binary and Docker image\" for usage."
+        } > notes.md
+        # --repo is needed because the working directory is not the git checkout
+        gh release create "$VERSION" dist/* \
+          --repo "$GITHUB_REPOSITORY" \
+          --target "$GITHUB_SHA" \
+          --title "$VERSION" \
+          --notes-file notes.md
diff --git a/.gitignore b/.gitignore
index 300d808..559d9b0 100644
--- a/.gitignore
+++ b/.gitignore
@@ -9,6 +9,8 @@ cmake_install.cmake
 https_dns_proxy
 *_unittest
 https_dns_proxy.service
+!portable/https_dns_proxy.service
+out/
 install_manifest.txt
 .ninja_deps
 .ninja_log
diff --git a/README.md b/README.md
index 312a45c..00bc854 100644
--- a/README.md
+++ b/README.md
@@ -34,7 +34,8 @@ only makes sense if you trust your DoH provider.
 
 ## Features
 
-* Tiny Size (<30kiB).
+* Tiny Size (<30kiB) when linked against system libraries
+  (the [portable build](#portable-binary-and-docker-image) is larger, see below).
 * Uses curl for HTTP/2 and pipelining, keeping resolve latencies extremely low.
 * Single-threaded, non-blocking select() server for use on resource-starved 
   embedded systems.
@@ -111,6 +112,70 @@ ExecStart=/usr/local/bin/https_dns_proxy \
   -u nobody -g nogroup -r https://doh.opendns.com/dns-query
 ```
 
+### Portable binary and Docker image
+
+Every day a GitHub Action checks this repository for changes since the last
+release. If there are any, it builds a new [release](../../releases/latest),
+tagged with the build date (`YYYY.MM.DD`), with these files:
+
+* `https_dns_proxy-linux-amd64` - portable, statically linked binary for Linux x86_64
+* `https_dns_proxy.service` - systemd unit for it
+* `SHA256SUMS` - checksums
+
+It also publishes a [Docker image](../../pkgs/container/https_dns_proxy) with the
+same binary at `ghcr.io/aarond10/https_dns_proxy` (tags: the release date and `latest`).
+Forks with the workflow enabled publish to their own `ghcr.io/<owner>/https_dns_proxy`
+and own releases.
+
+The portable binary has HTTP/3 (QUIC) support (`-q`) and needs no libraries on the
+target system. It runs on any Linux x86_64 distribution, regardless of its libc
+or installed packages.
+
+**Size:** the portable binary is about 8 MB instead of the <30 kiB of a regular
+build. It is statically linked: libcurl, OpenSSL, ngtcp2, nghttp3, nghttp2, c-ares,
+libev and the musl C library are all inside the executable, instead of being shared
+with the rest of the system. For the same reason, security fixes in these libraries
+reach the binary only through a new release, not through system package updates.
+
+Other differences from a regular build:
+
+* No systemd notify support (libsystemd has no static library), so the provided
+  unit uses `Type=simple`.
+* CA certificates are read from `/etc/ssl/certs/ca-certificates.crt`
+  (Debian, Ubuntu, Alpine, Arch and others). On distributions that keep them
+  elsewhere, use `-C`, for example `-C /etc/pki/tls/certs/ca-bundle.crt`
+  on Fedora/RHEL.
+
+Install with systemd:
+```
+$ curl -LO https://github.com/aarond10/https_dns_proxy/releases/latest/download/https_dns_proxy-linux-amd64
+$ curl -LO https://github.com/aarond10/https_dns_proxy/releases/latest/download/https_dns_proxy.service
+$ sudo install -m 755 https_dns_proxy-linux-amd64 /usr/local/bin/https_dns_proxy
+$ sudo install -m 644 https_dns_proxy.service /etc/systemd/system/
+$ sudo systemctl daemon-reload
+$ sudo systemctl enable --now https_dns_proxy
+```
+The unit runs the proxy with default options. To change them, use
+`sudo systemctl edit https_dns_proxy.service` as shown above.
+
+Run with Docker:
+```
+$ docker run -d --name https_dns_proxy \
+    -p 127.0.0.1:5053:5053/udp -p 127.0.0.1:5053:5053/tcp \
+    ghcr.io/aarond10/https_dns_proxy \
+    -r https://cloudflare-dns.com/dns-query
+```
+The image contains only the binary and a CA certificate bundle, in a single layer
+on an empty base image. It runs as an unprivileged user (65534) and listens on
+`0.0.0.0:5053` inside the container. Arguments after the image name are passed
+to `https_dns_proxy`.
+
+To build both locally (needs Docker with buildx), run from the repository root:
+```
+$ docker buildx build -f portable/Dockerfile --target binary --output type=local,dest=./out .
+$ docker buildx build -f portable/Dockerfile --target image -t https_dns_proxy .
+```
+
 ### OpenWRT package install
 
 There is a package in the [OpenWRT packages](https://github.com/openwrt/packages) repository as well.
@@ -142,7 +207,8 @@ user@arch:~# yay -S https-dns-proxy-git
 
 ### Docker install
 
-There is also an externally maintained [Docker image](https://hub.docker.com/r/bwmoran/https-dns-proxy) for latest git version. Documentation, Dockerfile, and entrypoint script can be viewed on [GitHub](https://github.com/moranbw/https-dns-proxy-docker).  An example run:
+See [Portable binary and Docker image](#portable-binary-and-docker-image) for the
+image built by this repository. There is also an externally maintained [Docker image](https://hub.docker.com/r/bwmoran/https-dns-proxy) for latest git version. Documentation, Dockerfile, and entrypoint script can be viewed on [GitHub](https://github.com/moranbw/https-dns-proxy-docker).  An example run:
 
 ```
 ### points towards AdGuard DNS, only use IPv4, increase logging ###
diff --git a/portable/Dockerfile b/portable/Dockerfile
new file mode 100644
index 0000000..1346a23
--- /dev/null
+++ b/portable/Dockerfile
@@ -0,0 +1,134 @@
+# Builds a fully static, portable https_dns_proxy binary with HTTP/3 (QUIC) support.
+# Dependencies are built from source (libev and c-ares come from Alpine), based on upstream development_build_with_http3.sh.
+#
+# Why some libraries are built from source instead of taken from Alpine packages
+# (the goal is one statically linked executable, so only static libraries (.a) can be used):
+#   curl    - Alpine's libcurl is built without HTTP/3 (no ngtcp2/nghttp3), and its static
+#             library also pulls in brotli, zstd, zlib, libidn2 and libpsl, which a DoH
+#             proxy does not use. A custom build keeps only what is needed.
+#   ngtcp2  - QUIC for curl. Its OpenSSL crypto backend must be built against the same
+#             OpenSSL that is linked into the binary.
+#   nghttp3 - HTTP/3 for curl, built together with ngtcp2 to keep matching versions.
+#   OpenSSL - Alpine ships the 3.5 LTS line, which would also work (ngtcp2 needs >= 3.5);
+#             it is built from source to get the latest release.
+#   nghttp2 - HTTP/2 for curl; Alpine has a static package, built from source to stay on
+#             the latest release together with the rest of the HTTP stack.
+# libev and c-ares are taken from Alpine: their packages already include static
+# libraries and match the latest upstream releases.
+#
+# Run from the repository root.
+#
+# Portable binary only:
+#   docker buildx build -f portable/Dockerfile --target binary --output type=local,dest=./out .
+#   -> ./out/https_dns_proxy
+#
+# Docker image (single layer on top of an empty image):
+#   docker buildx build -f portable/Dockerfile --target image -t https_dns_proxy .
+#
+# Why commit hashes and digests, not only tags:
+# git tags and Docker tags are mutable. Whoever controls an upstream repository (or an
+# attacker who got access to it) can move a tag to a different commit or image, and the
+# next build would silently use it. A commit hash or an image digest is a hash of the
+# content itself, so it cannot point to anything else. Each library below is cloned by
+# its tag (readable), and the build fails if the tag no longer points to the pinned
+# commit. Git submodules are pinned by the parent commit, so they are covered too.
+# To update a library, change both the tag and the commit, for example:
+#   git ls-remote https://github.com/curl/curl 'refs/tags/curl-8_22_0^{}'
+# To update the base image: docker buildx imagetools inspect alpine:3.24
+FROM alpine:3.24@sha256:be2656061b536c1883c4034790e21d0a09c5aaaf51968b89368a3c0371ea2c9a AS build
+
+ARG OPENSSL_VERSION=openssl-4.1.0
+ARG OPENSSL_COMMIT=2f4e3a5fec05394068cfa7379890ab552483a8a6
+ARG NGHTTP3_VERSION=v1.18.0
+ARG NGHTTP3_COMMIT=dbfc24286138cb0b6490160e7ca87fe1ce6722a0
+ARG NGTCP2_VERSION=v1.25.0
+ARG NGTCP2_COMMIT=f9e9ff01ad2c8116bc09de4f644b0028a61486a6
+ARG NGHTTP2_VERSION=v1.70.0
+ARG NGHTTP2_COMMIT=85e300c79fb6dbcfa9c1013215c8710c1c2cd3d2
+ARG CURL_VERSION=curl-8_23_0
+ARG CURL_COMMIT=3163ec065643ba20709f190111f42c3e1fe95273
+
+RUN apk add --no-cache build-base linux-headers cmake git perl pkgconf autoconf automake libtool curl \
+    libev-dev c-ares-dev ca-certificates
+
+ENV PREFIX=/opt/static
+ENV PKG_CONFIG_PATH=/opt/static/lib/pkgconfig
+ENV CFLAGS="-O2 -fPIC"
+WORKDIR /usr/src
+
+RUN git clone --depth 1 -b ${OPENSSL_VERSION} https://github.com/openssl/openssl \
+ && cd openssl \
+ && test "$(git rev-parse HEAD)" = "${OPENSSL_COMMIT}" \
+ && ./config --prefix=$PREFIX --libdir=lib --openssldir=/etc/ssl no-shared no-docs no-tests \
+ && make -j$(nproc) && make install_dev
+
+RUN git clone --depth 1 -b ${NGHTTP3_VERSION} https://github.com/ngtcp2/nghttp3 \
+ && cd nghttp3 \
+ && test "$(git rev-parse HEAD)" = "${NGHTTP3_COMMIT}" \
+ && git submodule update --init --depth 1 \
+ && autoreconf -fi \
+ && ./configure --prefix=$PREFIX --enable-lib-only --disable-shared --enable-static \
+ && make -j$(nproc) && make install
+
+RUN git clone --depth 1 -b ${NGTCP2_VERSION} https://github.com/ngtcp2/ngtcp2 \
+ && cd ngtcp2 \
+ && test "$(git rev-parse HEAD)" = "${NGTCP2_COMMIT}" \
+ && git submodule update --init --depth 1 \
+ && autoreconf -fi \
+ && ./configure --prefix=$PREFIX --enable-lib-only --disable-shared --enable-static --with-openssl \
+ && make -j$(nproc) && make install
+
+RUN git clone --depth 1 -b ${NGHTTP2_VERSION} https://github.com/nghttp2/nghttp2 \
+ && cd nghttp2 \
+ && test "$(git rev-parse HEAD)" = "${NGHTTP2_COMMIT}" \
+ && git submodule update --init --depth 1 \
+ && autoreconf -fi \
+ && ./configure --prefix=$PREFIX --enable-lib-only --disable-shared --enable-static \
+ && make -j$(nproc) && make install
+
+RUN git clone --depth 1 -b ${CURL_VERSION} https://github.com/curl/curl \
+ && cd curl \
+ && test "$(git rev-parse HEAD)" = "${CURL_COMMIT}" \
+ && autoreconf -fi \
+ && ./configure --prefix=$PREFIX --disable-shared --enable-static \
+      --with-openssl=$PREFIX --with-nghttp2=$PREFIX --with-ngtcp2=$PREFIX --with-nghttp3=$PREFIX \
+      --enable-ares \
+      --with-ca-bundle=/etc/ssl/certs/ca-certificates.crt --with-ca-path=/etc/ssl/certs \
+      --without-libpsl --without-libidn2 --without-brotli --without-zstd --without-zlib \
+      --without-libssh2 --without-gssapi --without-librtmp \
+      --disable-ldap --disable-ldaps --disable-docs --disable-manual \
+ && make -j$(nproc) && make install
+
+COPY . /usr/src/https_dns_proxy
+WORKDIR /usr/src/https_dns_proxy
+
+# libsystemd has no static library, so the build goes without sd_notify support.
+# Unit tests are built with the same static libraries as the binary and must pass,
+# otherwise the build fails. Tests that need network or root run in CI instead.
+RUN cmake . -DUSE_CLANG_TIDY=OFF \
+      -DBUILD_TESTING=ON \
+      -DCMAKE_PREFIX_PATH=$PREFIX \
+      -DCUSTOM_LIBCURL_INSTALL_PATH=$PREFIX \
+      -DCMAKE_EXE_LINKER_FLAGS="-static" \
+      -DCMAKE_C_STANDARD_LIBRARIES="$(pkg-config --static --libs libcurl libcares)" \
+ && make -j$(nproc) \
+ && ctest -L unit --output-on-failure \
+ && strip https_dns_proxy
+
+# Everything the image needs is gathered in one directory, so it is copied as a single layer.
+# /etc/services is needed by c-ares to resolve the "https" service name when bootstrapping
+# a resolver given by hostname.
+RUN mkdir -p /rootfs/etc/ssl/certs \
+ && cp https_dns_proxy /rootfs/https_dns_proxy \
+ && cp /etc/ssl/certs/ca-certificates.crt /rootfs/etc/ssl/certs/ \
+ && cp /etc/services /rootfs/etc/services
+
+FROM scratch AS binary
+COPY --from=build /usr/src/https_dns_proxy/https_dns_proxy /https_dns_proxy
+
+FROM scratch AS image
+COPY --from=build /rootfs/ /
+USER 65534:65534
+EXPOSE 5053/udp 5053/tcp
+# Listen on all interfaces inside the container; a later -a overrides it
+ENTRYPOINT ["/https_dns_proxy", "-a", "0.0.0.0"]
diff --git a/portable/https_dns_proxy.service b/portable/https_dns_proxy.service
new file mode 100644
index 0000000..73e13ea
--- /dev/null
+++ b/portable/https_dns_proxy.service
@@ -0,0 +1,51 @@
+# systemd unit for the portable (static) https_dns_proxy binary.
+#
+# Install:
+#   install -m 755 https_dns_proxy-linux-amd64 /usr/local/bin/https_dns_proxy
+#   install -m 644 https_dns_proxy.service /etc/systemd/system/
+#   systemctl daemon-reload && systemctl enable --now https_dns_proxy
+#
+# Change options with: systemctl edit https_dns_proxy
+[Unit]
+Description=https_dns_proxy - DNS-over-HTTPS (HTTP/3) proxy
+Wants=network-online.target nss-lookup.target
+After=network-online.target
+Before=nss-lookup.target
+
+[Service]
+# Static build has no libsystemd, so no sd_notify
+Type=simple
+DynamicUser=yes
+# Listens on 127.0.0.1:5053 by default
+ExecStart=/usr/local/bin/https_dns_proxy -v -v
+Restart=on-failure
+RestartSec=5
+TimeoutStopSec=10
+
+# Hardening
+NoNewPrivileges=yes
+CapabilityBoundingSet=
+AmbientCapabilities=
+ProtectSystem=strict
+ProtectHome=yes
+PrivateTmp=yes
+PrivateDevices=yes
+ProtectKernelTunables=yes
+ProtectKernelModules=yes
+ProtectKernelLogs=yes
+ProtectControlGroups=yes
+ProtectClock=yes
+ProtectHostname=yes
+ProtectProc=invisible
+RestrictAddressFamilies=AF_INET AF_INET6
+RestrictNamespaces=yes
+RestrictRealtime=yes
+RestrictSUIDSGID=yes
+LockPersonality=yes
+MemoryDenyWriteExecute=yes
+SystemCallArchitectures=native
+SystemCallFilter=@system-service
+SystemCallFilter=~@privileged @resources
+
+[Install]
+WantedBy=multi-user.target