I would like to use "sudo" in the systemd service. However I couldn't.

command_run_failed_log.log

2017-01-29 22:46:29.208 1863 DEBUG oslo_concurrency.processutils [-] Running cmd (subprocess): sudo nova-rootwrap /etc/nova/rootwrap.conf iptables-save -c execute /nix/store/gqs7kinmfnx5pznj20swm1l3g0gbxysv-python2.7-oslo.concurrency-3.14.0/lib/python2.7/site-packages/oslo_concurrency/processutils.py:344
2017-01-29 22:46:29.214 1863 DEBUG oslo_concurrency.processutils [-] u'sudo nova-rootwrap /etc/nova/rootwrap.conf iptables-save -c' failed. Retrying. execute /nix/store/gqs7kinmfnx5pznj20swm1l3g0gbxysv-python2.7-oslo.concurrency-3.14.0/lib/python2.7/site-packages/oslo_concurrency/processutils.py:426

----

2017-01-29 22:46:30.713 1863 DEBUG oslo_concurrency.processutils [-] Running cmd (subprocess): sudo nova-rootwrap /etc/nova/rootwrap.conf iptables-save -c execute /nix/store/gqs7kinmfnx5pznj20swm1l3g0gbxysv-python2.7-oslo.concurrency-3.14.0/lib/python2.7/site-packages/oslo_concurrency/processutils.py:344
2017-01-29 22:46:30.718 1863 DEBUG oslo_concurrency.processutils [-] u'sudo nova-rootwrap /etc/nova/rootwrap.conf iptables-save -c' failed. Not Retrying. execute /nix/store/gqs7kinmfnx5pznj20swm1l3g0gbxysv-python2.7-oslo.concurrency-3.14.0/lib/python2.7/site-packages/oslo_concurrency/processutils.py:422
2017-01-29 22:46:30.719 1863 DEBUG oslo_concurrency.lockutils [-] Lock "iptables" released by "nova.network.linux_net._apply" :: held 3.187s inner /nix/store/gqs7kinmfnx5pznj20swm1l3g0gbxysv-python2.7-oslo.concurrency-3.14.0/lib/python2.7/site-packages/oslo_concurrency/lockutils.py:282
2017-01-29 22:46:30.720 1863 CRITICAL nova [-] OSError: [Errno 2] No such file or directory

systemd.services.nova-api.nix

systemd.services.nova-api = {
  description = "OpenStack Compute Service nova-api Daemon";

  wantedBy = [ "multi-user.target" ];
  after = [
    "systemd-udev-settle.service"
  ];

  preStart = ''
    if [ ! -d "/var/lib/nova/log" ]; then
      mkdir -p /var/lib/nova/log
    fi
  '';
  
  script = ''
    PATH="/var/setuid-wrappers:$PATH"
    ${nova}/bin/nova-api --logfile /var/lib/nova/log/nova-api.log
  '';
  
  serviceConfig = {
    User = "nova";
    Group = "nova";
  };
};