nostr:npub17yjd7hmtk6fpn5e5npgf3ew0yev6sak9grch02djwe4fss2jxmtqfvq2fd At least on my machines I setup nftables to forbid root from having network access except for ssh.

And yeah I think the user for services when unspecified should be "nobody".