IMO using socket activation via systemd is a reasonable approach. I don't see any reason a non-service account should be running a service on port 80.