From 58f3b6fda7b193f34f483bba9a16aa5b34671b43 Mon Sep 17 00:00:00 2001
From: John Maguire <john@defined.net>
Date: Tue, 21 Jul 2026 19:32:33 -0400
Subject: [PATCH] Document rootless Nebula in example service script (#1814)

---
 examples/service_scripts/nebula.service | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/examples/service_scripts/nebula.service b/examples/service_scripts/nebula.service
index ab5218f8..295a6fcd 100644
--- a/examples/service_scripts/nebula.service
+++ b/examples/service_scripts/nebula.service
@@ -8,6 +8,15 @@ Before=sshd.service
 Type=notify
 NotifyAccess=main
 SyslogIdentifier=nebula
+
+# Uncomment to run as an unprivileged user with only CAP_NET_ADMIN. Requires a
+# nebula user that owns the config directory. Add CAP_NET_BIND_SERVICE to both
+# lines if any listener (lighthouse DNS, listen.port, stats, sshd) binds <1024.
+#User=nebula
+#Group=nebula
+#CapabilityBoundingSet=CAP_NET_ADMIN
+#AmbientCapabilities=CAP_NET_ADMIN
+
 ExecReload=/bin/kill -HUP $MAINPID
 ExecStart=/usr/local/bin/nebula -config /etc/nebula/config.yml
 Restart=always