Make sure user services are only run as ceres. Since openssh uses pam login, ssh root@watchIp would open a new systemd user session and start asteroid-launcher or other services as root

booster-qtcomponents-qt5: depends on asteroid-launcher.service instead of lipstick.service which doesn't exist