I'd avoid using root user (and /root dir), one can use a dedicated account for that.
Also, for witness node avoid adding plugins other than essential (i.e. no account_by_name, etc)
It's worth to note however, that a seed node can play a simple API role (broadcast transactions, handle cli_wallet, provide get_block to simple dApps, etc, etc.)