How to keep secrets out of the service file in systemd

Fix the relative-path failures that appear under systemd, run as a non-root user, and keep secrets out of the service file.