The unit file is similar to the one I initially wrote for regelwerk, which uses DynamicUser to isolate the process.