[Unit]
Description=Lock session
Before=sleep.target
[Service]
Type=simple
ExecStart=/usr/bin/physlock -d -u USERNAME
[Install]
WantedBy=sleep.target