[Unit]
Description=Enforce canonical /etc/systemd/resolved.conf (prevents hosts bypass)
After=local-fs.target

[Service]
Type=oneshot
ExecStart=/usr/local/sbin/enforce-resolved.sh
Nice=10
IOSchedulingClass=idle

[Install]
WantedBy=multi-user.target