This makes the service run as root which is no good (https://github.com/NixOS/nixpkgs/issues/11908), try to use `DynamicUser`, might need something like `AmbientCapabilities = lib.mkIf (cfg.port < 1024) [ "CAP_NET_BIND_SERVICE" ]`