Make service run as nobody using systemd