keyd: run systemd service as root user

        ExecStart = "${pkgs.keyd}/bin/keyd";

        Restart = "always";

        DynamicUser = true;

        # TODO investigate why it doesn't work propeprly with DynamicUser

        # See issue: https://github.com/NixOS/nixpkgs/issues/226346

        # DynamicUser = true;

        SupplementaryGroups = [

          config.users.groups.input.name

          config.users.groups.uinput.name

        ProtectHostname = true;

        PrivateUsers = true;

        PrivateMounts = true;

        PrivateTmp = true;

        RestrictNamespaces = true;

        ProtectKernelLogs = true;

        ProtectKernelModules = true;

        MemoryDenyWriteExecute = true;

        RestrictRealtime = true;

        LockPersonality = true;

        ProtectProc = "noaccess";

        ProtectProc = "invisible";

        SystemCallFilter = [

          "@system-service"

          "~@privileged"

          "~@resources"

        ];

        RestrictAddressFamilies = [ "AF_UNIX" ];

        RestrictSUIDSGID = true;

        IPAddressDeny = [ "any" ];

        NoNewPrivileges = true;

        ProtectSystem = "strict";

        ProcSubset = "pid";

        UMask = "0077";

      };

    };