A service with least privilege

How restricted a service is, you do not keep in your head — systemd works it out.

systemd-analyze security <unit> goes over a service's settings and gives a score from 0 to 10: the lower, the more restrictions. Without User= and protections a service scores around 9.6 with an UNSAFE label; the lines from the previous steps bring it down. The --threshold=N option adds a check to the score: the exit code is non-zero when the score is above the threshold. The threshold is written in tenths — a score of 9.6 is 96, and --threshold=50 lets through services scoring up to 5.0 (in the Wiki). That is how you put the check in a script.

root has one single power, but it can be handed out in parts — these are capabilities. A service that only needs a port below 1024 gets one capability, CAP_NET_BIND_SERVICE, instead of root's powers:

[Service]
User=gate
AmbientCapabilities=CAP_NET_BIND_SERVICE
CapabilityBoundingSet=CAP_NET_BIND_SERVICE

AmbientCapabilities grants the capability to the process, CapabilityBoundingSet leaves only that one on the list of allowed ones — the service has nothing else, even if it asks.