# Lets non-root processes bind ports >= 22, so sish (hostNetwork, uid 65534,
# no capabilities) can listen on :22 (Gitea SSH), :80 and :443.
# The edge runs nothing else that could grab 22-79.
machine:
  sysctls:
    net.ipv4.ip_unprivileged_port_start: "22"