Increasing the security of the two systemd units

[81909ce2298f99ddafa37936ba43eaac]

Is your feature request related to a problem? Please describe.
Rustdesk provides two systemd units (see https://github.com/rustdesk/rustdesk-server/tree/master/systemd). These two unit files offer much less security than would be possible.

Describe the solution you'd like

1. The Rustdesk services should not be started with root privileges. When installing the deb packages, a suitable user and group should be created, for example "rustdesk", and the access rights of the directories "/var/lib/rustdesk-server/" and "/var/log/rustdesk-server" should be set accordingly.

2. The changes mentioned under point 1 should be taken into account in the two systemd units (rustdesk-hbbr.service, rustdesk-hbbs.service). Furthermore, the execution environment of the services should be configured more restrictively in these files. You can see what the modified unit files might look like in the examples attached here.

Describe alternatives you've considered
Leave it as it is, but this weakens security IMHO

Additional context
Add any other context about the feature request here.

[81909ce2298f99ddafa37936ba43eaac]

I don't know why, but the button to add files didn't work. I will post the files here:

rustdesk-hbbr.service

[Unit]
Description=Rustdesk Relay Server

[Service]
Type=simple
LimitNOFILE=1000000
ExecStart=/usr/bin/hbbr -k _
WorkingDirectory=/var/lib/rustdesk-server/
User=rustdesk
Group=rustdesk
Restart=always
StandardOutput=append:/var/log/rustdesk-server/hbbr.log
StandardError=append:/var/log/rustdesk-server/hbbr.error
# Restart service after 10 seconds if node service crashes
RestartSec=10
# Set security and hardening options
NoNewPrivileges=yes
PrivateTmp=yes
PrivateDevices=yes
DevicePolicy=closed
ProtectSystem=strict
ProtectHome=read-only
ProtectControlGroups=yes
ProtectKernelModules=yes
ProtectKernelTunables=yes
RestrictNamespaces=yes
RestrictRealtime=yes
RestrictSUIDSGID=yes
MemoryDenyWriteExecute=yes
LockPersonality=yes
ReadWritePaths=/var/lib/rustdesk-server /var/log/rustdesk-server

[Install]
WantedBy=multi-user.target

rustdesk-hbbs.service

[Unit]
Description=Rustdesk Signal Server

[Service]
Type=simple
LimitNOFILE=1000000
Environment="TEST_HBBS=no"
ExecStart=/usr/bin/hbbs -k _
WorkingDirectory=/var/lib/rustdesk-server/
User=rustdesk
Group=rustdesk
Restart=always
StandardOutput=append:/var/log/rustdesk-server/hbbs.log
StandardError=append:/var/log/rustdesk-server/hbbs.error
# Restart service after 10 seconds if node service crashes
RestartSec=10
# Set security and hardening options
NoNewPrivileges=yes
PrivateTmp=yes
PrivateDevices=yes
DevicePolicy=closed
ProtectSystem=strict
ProtectHome=read-only
ProtectControlGroups=yes
ProtectKernelModules=yes
ProtectKernelTunables=yes
RestrictNamespaces=yes
RestrictRealtime=yes
RestrictSUIDSGID=yes
MemoryDenyWriteExecute=yes
LockPersonality=yes
ReadWritePaths=/var/lib/rustdesk-server /var/log/rustdesk-server

[Install]
WantedBy=multi-user.target