Make unique dynamic user for each ssh connection and improve doc

nnss-ssh@.service

@@ -8,9 +8,13 @@ StopWhenUnneeded=yes
 Type=notify
 NotifyAccess=all
 DynamicUser=yes
+User=nnss-ssh-%i
 
 LoadCredential=ssh:/etc/nnss/%i
 
+# Note: App service running in the namespace should have Restart=always,
+# otherwise, both the ssh connection and the app will be stopped as this unit
+# has StopWhenUnneeded set
 # https://enotty.pipebreaker.pl/posts/2024/01/how-systemd-exponential-restart-delay-works/
 Restart=on-failure
 RestartSec=5min
@@ -18,6 +22,7 @@ RestartSteps=6
 RestartMaxDelaySec=24h
 
 RuntimeDirectory=nnss-%i
+RuntimeDirectoryMode=0750
 StateDirectory=nnss-%i
 ExecStart=ssh -F /usr/lib/nnss/ssh_config default
 

nnssB@.service

@@ -10,7 +10,7 @@ NotifyAccess=all
 RuntimeDirectory=nnssB%i
 
 # Add SOCKS_PROXY environment variable to below file. E.g.
-# SOCKS_PROXY=socks5://127.0.0.1:9050
+# echo SOCKS_PROXY=socks5://127.0.0.1:9050 > /etc/nnss/env_tor
 EnvironmentFile=/etc/nnss/env_%i
 
 ExecStart=/usr/lib/nnss/tunsocks.sh "%i" use_env setup