roles/dockerserver: use SupplementaryGroups instead of changing traefik group

roles/dockerserver.nix

@@ -37,11 +37,10 @@ in
         network = dockerTraefikNetwork;
         watch = true;
       };
-
-      group = "docker";
     };
 
     systemd.services.traefik.serviceConfig = mkIf config.services.traefik.enable {
+      SupplementaryGroups = [ "docker" ];
       BindReadOnlyPaths = [ dockerSocketPath ];
     };
   };