Started a NixOS Flake for declarative network namespace isolation for systemd services: https://github.com/elsbrock/netns-unit/