use port 8080 instead

common/network/pia-vpn/default.nix

@@ -56,8 +56,8 @@ let
               default = null;
               description = ''
                 Target port to forward to. If null, forwards to the same PIA-assigned port.
-                PIA-assigned ports below 1000 are rejected to avoid accidentally
-                forwarding traffic to privileged services.
+                PIA-assigned ports below 10000 are rejected to avoid accidentally
+                forwarding traffic to other services.
               '';
             };
             protocol = mkOption {

common/network/pia-vpn/vpn-container.nix

@@ -44,8 +44,8 @@ let
       '';
     in
     ''
-      if [ "$PORT" -lt 1000 ]; then
-        echo "ERROR: PIA assigned privileged port $PORT (< 1000), refusing to set up DNAT" >&2
+      if [ "$PORT" -lt 10000 ]; then
+        echo "ERROR: PIA assigned low port $PORT (< 10000), refusing to set up DNAT" >&2
       else
         ${tcpRules}
         ${udpRules}