···

       
83
       
 
       
      #fourstore = 42; # dropped in 20.03

     

       
84
       
 
       
      #fourstorehttp = 43; # dropped in 20.03

     

       
85
       
 
       
      virtuoso = 44;

     

       
86
       
-
       
      rtkit = 45;

     

       
87
       
 
       
      dovecot2 = 46;

     

       
88
       
 
       
      dovenull2 = 47;

     

       
89
       
 
       
      prayer = 49;

     

       
90
       
 
       
      mpd = 50;

     

       
91
       
 
       
      clamav = 51;

     

       
92
       
 
       
      fprot = 52;

     

       
93
       
-
       
      bind = 53;

     

       
94
       
 
       
      wwwrun = 54;

     

       
95
       
 
       
      #adm = 55; # unused

     

       
96
       
 
       
      spamd = 56;

     
···

       
134
       
 
       
      firebird = 95;

     

       
135
       
 
       
      #keys = 96; # unused

     

       
136
       
 
       
      #haproxy = 97; # dynamically allocated as of 2020-03-11

     

       
137
       
-
       
      mongodb = 98;

     

       
138
       
 
       
      #openldap = 99; # dynamically allocated as of PR#94610

     

       
139
       
 
       
      #users = 100; # unused

     

       
140
       
 
       
      cgminer = 101;

     

       
141
       
 
       
      munin = 102;

     

       
142
       
 
       
      logcheck = 103;

     

       
143
       
-
       
      nix-ssh = 104;

     

       
144
       
 
       
      dictd = 105;

     

       
145
       
 
       
      couchdb = 106;

     

       
146
       
 
       
      #searx = 107; # dynamically allocated as of 2020-10-27

     
···

       
149
       
 
       
      systemd-journal-gateway = 110;

     

       
150
       
 
       
      #notbit = 111; # unused

     

       
151
       
 
       
      aerospike = 111;

     

       
152
       
-
       
      ngircd = 112;

     

       
153
       
 
       
      #btsync = 113; # unused

     

       
154
       
-
       
      minecraft = 114;

     

       
155
       
 
       
      vault = 115;

     

       
156
       
 
       
      rippled = 116;

     

       
157
       
 
       
      murmur = 117;

     
···

       
169
       
 
       
      mopidy = 130;

     

       
170
       
 
       
      #docker = 131; # unused

     

       
171
       
 
       
      gdm = 132;

     

       
172
       
-
       
      dhcpd = 133;

     

       
173
       
 
       
      siproxd = 134;

     

       
174
       
 
       
      mlmmj = 135;

     

       
175
       
-
       
      neo4j = 136;

     

       
176
       
 
       
      riemann = 137;

     

       
177
       
 
       
      riemanndash = 138;

     

       
178
       
-
       
      radvd = 139;

     

       
179
       
-
       
      zookeeper = 140;

     

       
180
       
-
       
      dnsmasq = 141;

     

       
181
       
 
       
      #uhub = 142; # unused

     

       
182
       
 
       
      yandexdisk = 143;

     

       
183
       
 
       
      mxisd = 144; # was once collectd

     

       
184
       
-
       
      consul = 145;

     

       
185
       
 
       
      mailpile = 146;

     

       
186
       
 
       
      redmine = 147;

     

       
187
       
 
       
      #seeks = 148; # removed 2020-06-21

     
···

       
192
       
 
       
      systemd-resolve = 153;

     

       
193
       
 
       
      systemd-timesync = 154;

     

       
194
       
 
       
      liquidsoap = 155;

     

       
195
       
-
       
      etcd = 156;

     

       
196
       
 
       
      hbase = 158;

     

       
197
       
 
       
      opentsdb = 159;

     

       
198
       
 
       
      scollector = 160;

     
···

       
204
       
 
       
      tox-bootstrapd = 166;

     

       
205
       
 
       
      cadvisor = 167;

     

       
206
       
 
       
      nylon = 168;

     

       
207
       
-
       
      apache-kafka = 169;

     

       
208
       
 
       
      #panamax = 170; # unused

     

       
209
       
 
       
      exim = 172;

     

       
210
       
 
       
      #fleet = 173; # unused

     
···

       
241
       
 
       
      gateone = 207;

     

       
242
       
 
       
      namecoin = 208;

     

       
243
       
 
       
      #lxd = 210; # unused

     

       
244
       
-
       
      kibana = 211;

     

       
245
       
 
       
      xtreemfs = 212;

     

       
246
       
 
       
      calibre-server = 213;

     

       
247
       
 
       
      heapster = 214;

     
···

       
264
       
 
       
      avahi-autoipd = 231;

     

       
265
       
 
       
      nntp-proxy = 232;

     

       
266
       
 
       
      mjpg-streamer = 233;

     

       
267
       
-
       
      radicale = 234;

     

       
268
       
 
       
      hydra-queue-runner = 235;

     

       
269
       
 
       
      hydra-www = 236;

     

       
270
       
 
       
      syncthing = 237;

     
···

       
272
       
 
       
      taskd = 240;

     

       
273
       
 
       
      # factorio = 241; # DynamicUser = true

     

       
274
       
 
       
      # emby = 242; # unusued, removed 2019-05-01

     

       
275
       
-
       
      graylog = 243;

     

       
276
       
 
       
      sniproxy = 244;

     

       
277
       
 
       
      nzbget = 245;

     

       
278
       
 
       
      mosquitto = 246;

     

       
279
       
 
       
      toxvpn = 247;

     

       
280
       
 
       
      # squeezelite = 248; # DynamicUser = true

     

       
281
       
 
       
      turnserver = 249;

     

       
282
       
-
       
      smokeping = 250;

     

       
283
       
 
       
      gocd-agent = 251;

     

       
284
       
 
       
      gocd-server = 252;

     

       
285
       
 
       
      terraria = 253;

     
···

       
553
       
 
       
      #shout = 206; #unused

     

       
554
       
 
       
      gateone = 207;

     

       
555
       
 
       
      namecoin = 208;

     

       
556
       
-
       
      lxd = 210; # unused

     

       
557
       
 
       
      #kibana = 211;

     

       
558
       
 
       
      xtreemfs = 212;

     

       
559
       
 
       
      calibre-server = 213;

     
···

       
572
       
 
       
      cfdyndns = 227;

     

       
573
       
 
       
      pdnsd = 229;

     

       
574
       
 
       
      octoprint = 230;

     

       
575
       
-
       
      radicale = 234;

     

       
576
       
 
       
      syncthing = 237;

     

       
577
       
 
       
      caddy = 239;

     

       
578
       
 
       
      taskd = 240;

     
···

       
584
       
 
       
      #toxvpn = 247; # unused

     

       
585
       
 
       
      #squeezelite = 248; #unused

     

       
586
       
 
       
      turnserver = 249;

     

       
587
       
-
       
      smokeping = 250;

     

       
588
       
 
       
      gocd-agent = 251;

     

       
589
       
 
       
      gocd-server = 252;

     

       
590
       
 
       
      terraria = 253;

     

···

       
83
       
 
       
      #fourstore = 42; # dropped in 20.03

     

       
84
       
 
       
      #fourstorehttp = 43; # dropped in 20.03

     

       
85
       
 
       
      virtuoso = 44;

     

       
86
       
+
       
      #rtkit = 45; # dynamically allocated 2021-09-03

     

       
87
       
 
       
      dovecot2 = 46;

     

       
88
       
 
       
      dovenull2 = 47;

     

       
89
       
 
       
      prayer = 49;

     

       
90
       
 
       
      mpd = 50;

     

       
91
       
 
       
      clamav = 51;

     

       
92
       
 
       
      fprot = 52;

     

       
93
       
+
       
      # bind = 53; #dynamically allocated as of 2021-09-03

     

       
94
       
 
       
      wwwrun = 54;

     

       
95
       
 
       
      #adm = 55; # unused

     

       
96
       
 
       
      spamd = 56;

     
···

       
134
       
 
       
      firebird = 95;

     

       
135
       
 
       
      #keys = 96; # unused

     

       
136
       
 
       
      #haproxy = 97; # dynamically allocated as of 2020-03-11

     

       
137
       
+
       
      #mongodb = 98; #dynamically allocated as of 2021-09-03

     

       
138
       
 
       
      #openldap = 99; # dynamically allocated as of PR#94610

     

       
139
       
 
       
      #users = 100; # unused

     

       
140
       
 
       
      cgminer = 101;

     

       
141
       
 
       
      munin = 102;

     

       
142
       
 
       
      logcheck = 103;

     

       
143
       
+
       
      #nix-ssh = 104; #dynamically allocated as of 2021-09-03

     

       
144
       
 
       
      dictd = 105;

     

       
145
       
 
       
      couchdb = 106;

     

       
146
       
 
       
      #searx = 107; # dynamically allocated as of 2020-10-27

     
···

       
149
       
 
       
      systemd-journal-gateway = 110;

     

       
150
       
 
       
      #notbit = 111; # unused

     

       
151
       
 
       
      aerospike = 111;

     

       
152
       
+
       
      #ngircd = 112; #dynamically allocated as of 2021-09-03

     

       
153
       
 
       
      #btsync = 113; # unused

     

       
154
       
+
       
      #minecraft = 114; #dynamically allocated as of 2021-09-03

     

       
155
       
 
       
      vault = 115;

     

       
156
       
 
       
      rippled = 116;

     

       
157
       
 
       
      murmur = 117;

     
···

       
169
       
 
       
      mopidy = 130;

     

       
170
       
 
       
      #docker = 131; # unused

     

       
171
       
 
       
      gdm = 132;

     

       
172
       
+
       
      #dhcpd = 133; # dynamically allocated as of 2021-09-03

     

       
173
       
 
       
      siproxd = 134;

     

       
174
       
 
       
      mlmmj = 135;

     

       
175
       
+
       
      #neo4j = 136;# dynamically allocated as of 2021-09-03

     

       
176
       
 
       
      riemann = 137;

     

       
177
       
 
       
      riemanndash = 138;

     

       
178
       
+
       
      #radvd = 139;# dynamically allocated as of 2021-09-03

     

       
179
       
+
       
      #zookeeper = 140;# dynamically allocated as of 2021-09-03

     

       
180
       
+
       
      #dnsmasq = 141;# dynamically allocated as of 2021-09-03

     

       
181
       
 
       
      #uhub = 142; # unused

     

       
182
       
 
       
      yandexdisk = 143;

     

       
183
       
 
       
      mxisd = 144; # was once collectd

     

       
184
       
+
       
      #consul = 145;# dynamically allocated as of 2021-09-03

     

       
185
       
 
       
      mailpile = 146;

     

       
186
       
 
       
      redmine = 147;

     

       
187
       
 
       
      #seeks = 148; # removed 2020-06-21

     
···

       
192
       
 
       
      systemd-resolve = 153;

     

       
193
       
 
       
      systemd-timesync = 154;

     

       
194
       
 
       
      liquidsoap = 155;

     

       
195
       
+
       
      #etcd = 156;# dynamically allocated as of 2021-09-03

     

       
196
       
 
       
      hbase = 158;

     

       
197
       
 
       
      opentsdb = 159;

     

       
198
       
 
       
      scollector = 160;

     
···

       
204
       
 
       
      tox-bootstrapd = 166;

     

       
205
       
 
       
      cadvisor = 167;

     

       
206
       
 
       
      nylon = 168;

     

       
207
       
+
       
      #apache-kafka = 169;# dynamically allocated as of 2021-09-03

     

       
208
       
 
       
      #panamax = 170; # unused

     

       
209
       
 
       
      exim = 172;

     

       
210
       
 
       
      #fleet = 173; # unused

     
···

       
241
       
 
       
      gateone = 207;

     

       
242
       
 
       
      namecoin = 208;

     

       
243
       
 
       
      #lxd = 210; # unused

     

       
244
       
+
       
      #kibana = 211;# dynamically allocated as of 2021-09-03

     

       
245
       
 
       
      xtreemfs = 212;

     

       
246
       
 
       
      calibre-server = 213;

     

       
247
       
 
       
      heapster = 214;

     
···

       
264
       
 
       
      avahi-autoipd = 231;

     

       
265
       
 
       
      nntp-proxy = 232;

     

       
266
       
 
       
      mjpg-streamer = 233;

     

       
267
       
+
       
      #radicale = 234;# dynamically allocated as of 2021-09-03

     

       
268
       
 
       
      hydra-queue-runner = 235;

     

       
269
       
 
       
      hydra-www = 236;

     

       
270
       
 
       
      syncthing = 237;

     
···

       
272
       
 
       
      taskd = 240;

     

       
273
       
 
       
      # factorio = 241; # DynamicUser = true

     

       
274
       
 
       
      # emby = 242; # unusued, removed 2019-05-01

     

       
275
       
+
       
      #graylog = 243;# dynamically allocated as of 2021-09-03

     

       
276
       
 
       
      sniproxy = 244;

     

       
277
       
 
       
      nzbget = 245;

     

       
278
       
 
       
      mosquitto = 246;

     

       
279
       
 
       
      toxvpn = 247;

     

       
280
       
 
       
      # squeezelite = 248; # DynamicUser = true

     

       
281
       
 
       
      turnserver = 249;

     

       
282
       
+
       
      #smokeping = 250;# dynamically allocated as of 2021-09-03

     

       
283
       
 
       
      gocd-agent = 251;

     

       
284
       
 
       
      gocd-server = 252;

     

       
285
       
 
       
      terraria = 253;

     
···

       
553
       
 
       
      #shout = 206; #unused

     

       
554
       
 
       
      gateone = 207;

     

       
555
       
 
       
      namecoin = 208;

     

       
556
       
+
       
      #lxd = 210; # unused

     

       
557
       
 
       
      #kibana = 211;

     

       
558
       
 
       
      xtreemfs = 212;

     

       
559
       
 
       
      calibre-server = 213;

     
···

       
572
       
 
       
      cfdyndns = 227;

     

       
573
       
 
       
      pdnsd = 229;

     

       
574
       
 
       
      octoprint = 230;

     

       
575
       
+
       
      #radicale = 234;# dynamically allocated as of 2021-09-03

     

       
576
       
 
       
      syncthing = 237;

     

       
577
       
 
       
      caddy = 239;

     

       
578
       
 
       
      taskd = 240;

     
···

       
584
       
 
       
      #toxvpn = 247; # unused

     

       
585
       
 
       
      #squeezelite = 248; #unused

     

       
586
       
 
       
      turnserver = 249;

     

       
587
       
+
       
      #smokeping = 250;# dynamically allocated as of 2021-09-03

     

       
588
       
 
       
      gocd-agent = 251;

     

       
589
       
 
       
      gocd-server = 252;

     

       
590
       
 
       
      terraria = 253;

     

···

       
35
       
 
       
    services.dbus.packages = [ pkgs.rtkit ];

     

       
36
       
 
       


     

       
37
       
 
       
    users.users.rtkit =

     

       
38
       
-
       
      { uid = config.ids.uids.rtkit;

     

       
0
       
 
       

     

       
0
       
 
       

     

       
39
       
 
       
        description = "RealtimeKit daemon";

     

       
40
       
 
       
      };

     

       
0
       
 
       

     

       
41
       
 
       


     

       
42
       
 
       
  };

     

       
43
       
 
       


     

···

       
35
       
 
       
    services.dbus.packages = [ pkgs.rtkit ];

     

       
36
       
 
       


     

       
37
       
 
       
    users.users.rtkit =

     

       
38
       
+
       
      {

     

       
39
       
+
       
        isSystemUser = true;

     

       
40
       
+
       
        group = "rtkit";

     

       
41
       
 
       
        description = "RealtimeKit daemon";

     

       
42
       
 
       
      };

     

       
43
       
+
       
    users.groups.rtkit = {};

     

       
44
       
 
       


     

       
45
       
 
       
  };

     

       
46
       
 
       


     

···

       
169
       
 
       
        (map (mkAuthorizedKey cfg false) cfg.authorizedKeys

     

       
170
       
 
       
        ++ map (mkAuthorizedKey cfg true) cfg.authorizedKeysAppendOnly);

     

       
171
       
 
       
      useDefaultShell = true;

     

       
0
       
 
       

     

       
172
       
 
       
      isSystemUser = true;

     

       
173
       
 
       
    };

     

       
174
       
 
       
    groups.${cfg.group} = { };

     

···

       
169
       
 
       
        (map (mkAuthorizedKey cfg false) cfg.authorizedKeys

     

       
170
       
 
       
        ++ map (mkAuthorizedKey cfg true) cfg.authorizedKeysAppendOnly);

     

       
171
       
 
       
      useDefaultShell = true;

     

       
172
       
+
       
      group = cfg.group;

     

       
173
       
 
       
      isSystemUser = true;

     

       
174
       
 
       
    };

     

       
175
       
 
       
    groups.${cfg.group} = { };

     

···

       
185
       
 
       
    users.users = optionalAttrs (cfg.user == "influxdb") {

     

       
186
       
 
       
      influxdb = {

     

       
187
       
 
       
        uid = config.ids.uids.influxdb;

     

       
0
       
 
       

     

       
188
       
 
       
        description = "Influxdb daemon user";

     

       
189
       
 
       
      };

     

       
190
       
 
       
    };

     

···

       
185
       
 
       
    users.users = optionalAttrs (cfg.user == "influxdb") {

     

       
186
       
 
       
      influxdb = {

     

       
187
       
 
       
        uid = config.ids.uids.influxdb;

     

       
188
       
+
       
        group = "influxdb";

     

       
189
       
 
       
        description = "Influxdb daemon user";

     

       
190
       
 
       
      };

     

       
191
       
 
       
    };

     

···

       
67
       
 
       
    users.users = optionalAttrs (cfg.user == "memcached") {

     

       
68
       
 
       
      memcached.description = "Memcached server user";

     

       
69
       
 
       
      memcached.isSystemUser = true;

     

       
0
       
 
       

     

       
70
       
 
       
    };

     

       
0
       
 
       

     

       
71
       
 
       


     

       
72
       
 
       
    environment.systemPackages = [ memcached ];

     

       
73
       
 
       


     

···

       
67
       
 
       
    users.users = optionalAttrs (cfg.user == "memcached") {

     

       
68
       
 
       
      memcached.description = "Memcached server user";

     

       
69
       
 
       
      memcached.isSystemUser = true;

     

       
70
       
+
       
      memcached.group = "memcached";

     

       
71
       
 
       
    };

     

       
72
       
+
       
    users.groups = optionalAttrs (cfg.user == "memcached") { memcached = {}; };

     

       
73
       
 
       


     

       
74
       
 
       
    environment.systemPackages = [ memcached ];

     

       
75
       
 
       


     

···

       
123
       
 
       


     

       
124
       
 
       
    users.users.mongodb = mkIf (cfg.user == "mongodb")

     

       
125
       
 
       
      { name = "mongodb";

     

       
126
       
-
       
        uid = config.ids.uids.mongodb;

     

       
0
       
 
       

     

       
127
       
 
       
        description = "MongoDB server user";

     

       
128
       
 
       
      };

     

       
0
       
 
       

     

       
129
       
 
       


     

       
130
       
 
       
    environment.systemPackages = [ mongodb ];

     

       
131
       
 
       


     

···

       
123
       
 
       


     

       
124
       
 
       
    users.users.mongodb = mkIf (cfg.user == "mongodb")

     

       
125
       
 
       
      { name = "mongodb";

     

       
126
       
+
       
        isSystemUser = true;

     

       
127
       
+
       
        group = "mongodb";

     

       
128
       
 
       
        description = "MongoDB server user";

     

       
129
       
 
       
      };

     

       
130
       
+
       
    users.groups.mongodb = mkIf (cfg.user == "mongodb") {};

     

       
131
       
 
       


     

       
132
       
 
       
    environment.systemPackages = [ mongodb ];

     

       
133
       
 
       


     

···

       
651
       
 
       
      environment.systemPackages = [ cfg.package ];

     

       
652
       
 
       


     

       
653
       
 
       
      users.users.neo4j = {

     

       
654
       
-
       
        uid = config.ids.uids.neo4j;

     

       
0
       
 
       

     

       
655
       
 
       
        description = "Neo4j daemon user";

     

       
656
       
 
       
        home = cfg.directories.home;

     

       
657
       
 
       
      };

     

       
0
       
 
       

     

       
658
       
 
       
    };

     

       
659
       
 
       


     

       
660
       
 
       
  meta = {

     

···

       
651
       
 
       
      environment.systemPackages = [ cfg.package ];

     

       
652
       
 
       


     

       
653
       
 
       
      users.users.neo4j = {

     

       
654
       
+
       
        isSystemUser = true;

     

       
655
       
+
       
        group = "neo4j";

     

       
656
       
 
       
        description = "Neo4j daemon user";

     

       
657
       
 
       
        home = cfg.directories.home;

     

       
658
       
 
       
      };

     

       
659
       
+
       
      users.groups.neo4j = {};

     

       
660
       
 
       
    };

     

       
661
       
 
       


     

       
662
       
 
       
  meta = {

     

···

       
246
       
 
       


     

       
247
       
 
       
    users.users.redis = {

     

       
248
       
 
       
      description = "Redis database user";

     

       
0
       
 
       

     

       
249
       
 
       
      isSystemUser = true;

     

       
250
       
 
       
    };

     

       
251
       
 
       
    users.groups.redis = {};

     

···

       
246
       
 
       


     

       
247
       
 
       
    users.users.redis = {

     

       
248
       
 
       
      description = "Redis database user";

     

       
249
       
+
       
      group = "redis";

     

       
250
       
 
       
      isSystemUser = true;

     

       
251
       
 
       
    };

     

       
252
       
 
       
    users.groups.redis = {};

     

···

       
167
       
 
       
      description     = "Minecraft server service user";

     

       
168
       
 
       
      home            = cfg.dataDir;

     

       
169
       
 
       
      createHome      = true;

     

       
170
       
-
       
      uid             = config.ids.uids.minecraft;

     

       
0
       
 
       

     

       
171
       
 
       
    };

     

       
0
       
 
       

     

       
172
       
 
       


     

       
173
       
 
       
    systemd.services.minecraft-server = {

     

       
174
       
 
       
      description   = "Minecraft Server Service";

     

···

       
167
       
 
       
      description     = "Minecraft server service user";

     

       
168
       
 
       
      home            = cfg.dataDir;

     

       
169
       
 
       
      createHome      = true;

     

       
170
       
+
       
      isSystemUser    = true;

     

       
171
       
+
       
      group           = "minecraft";

     

       
172
       
 
       
    };

     

       
173
       
+
       
    users.groups.minecraft = {};

     

       
174
       
 
       


     

       
175
       
 
       
    systemd.services.minecraft-server = {

     

       
176
       
 
       
      description   = "Minecraft Server Service";

     

···

       
128
       
 
       


     

       
129
       
 
       
    users.users = mkIf (cfg.user == "graylog") {

     

       
130
       
 
       
      graylog = {

     

       
131
       
-
       
        uid = config.ids.uids.graylog;

     

       
0
       
 
       

     

       
132
       
 
       
        description = "Graylog server daemon user";

     

       
133
       
 
       
      };

     

       
134
       
 
       
    };

     

       
0
       
 
       

     

       
135
       
 
       


     

       
136
       
 
       
    systemd.tmpfiles.rules = [

     

       
137
       
 
       
      "d '${cfg.messageJournalDir}' - ${cfg.user} - - -"

     

···

       
128
       
 
       


     

       
129
       
 
       
    users.users = mkIf (cfg.user == "graylog") {

     

       
130
       
 
       
      graylog = {

     

       
131
       
+
       
        isSystemUser = true;

     

       
132
       
+
       
        group = "graylog";

     

       
133
       
 
       
        description = "Graylog server daemon user";

     

       
134
       
 
       
      };

     

       
135
       
 
       
    };

     

       
136
       
+
       
    users.groups = mkIf (cfg.user == "graylog") {};

     

       
137
       
 
       


     

       
138
       
 
       
    systemd.tmpfiles.rules = [

     

       
139
       
 
       
      "d '${cfg.messageJournalDir}' - ${cfg.user} - - -"

     

···

       
165
       
 
       


     

       
166
       
 
       
    users.users.airsonic = {

     

       
167
       
 
       
      description = "Airsonic service user";

     

       
0
       
 
       

     

       
168
       
 
       
      name = cfg.user;

     

       
169
       
 
       
      home = cfg.home;

     

       
170
       
 
       
      createHome = true;

     

       
171
       
 
       
      isSystemUser = true;

     

       
172
       
 
       
    };

     

       
0
       
 
       

     

       
173
       
 
       
  };

     

       
174
       
 
       
}

     

···

       
165
       
 
       


     

       
166
       
 
       
    users.users.airsonic = {

     

       
167
       
 
       
      description = "Airsonic service user";

     

       
168
       
+
       
      group = "airsonic";

     

       
169
       
 
       
      name = cfg.user;

     

       
170
       
 
       
      home = cfg.home;

     

       
171
       
 
       
      createHome = true;

     

       
172
       
 
       
      isSystemUser = true;

     

       
173
       
 
       
    };

     

       
174
       
+
       
    users.groups.airsonic = {};

     

       
175
       
 
       
  };

     

       
176
       
 
       
}

     

···

       
120
       
 
       
    environment.systemPackages = [cfg.package];

     

       
121
       
 
       


     

       
122
       
 
       
    users.users.apache-kafka = {

     

       
123
       
-
       
      uid = config.ids.uids.apache-kafka;

     

       
0
       
 
       

     

       
124
       
 
       
      description = "Apache Kafka daemon user";

     

       
125
       
 
       
      home = head cfg.logDirs;

     

       
126
       
 
       
    };

     

       
0
       
 
       

     

       
127
       
 
       


     

       
128
       
 
       
    systemd.tmpfiles.rules = map (logDir: "d '${logDir}' 0700 apache-kafka - - -") cfg.logDirs;

     

       
129
       
 
       


     

···

       
120
       
 
       
    environment.systemPackages = [cfg.package];

     

       
121
       
 
       


     

       
122
       
 
       
    users.users.apache-kafka = {

     

       
123
       
+
       
      isSystemUser = true;

     

       
124
       
+
       
      group = "apache-kafka";

     

       
125
       
 
       
      description = "Apache Kafka daemon user";

     

       
126
       
 
       
      home = head cfg.logDirs;

     

       
127
       
 
       
    };

     

       
128
       
+
       
    users.groups.apache-kafka = {};

     

       
129
       
 
       


     

       
130
       
 
       
    systemd.tmpfiles.rules = map (logDir: "d '${logDir}' 0700 apache-kafka - - -") cfg.logDirs;

     

       
131
       
 
       


     

···

       
151
       
 
       
        home = cfg.storagePath;

     

       
152
       
 
       
      }

     

       
153
       
 
       
      else {}) // {

     

       
0
       
 
       

     

       
154
       
 
       
        isSystemUser = true;

     

       
155
       
 
       
      };

     

       
0
       
 
       

     

       
156
       
 
       
  };

     

       
157
       
 
       
}

     

···

       
151
       
 
       
        home = cfg.storagePath;

     

       
152
       
 
       
      }

     

       
153
       
 
       
      else {}) // {

     

       
154
       
+
       
        group = "docker-registry";

     

       
155
       
 
       
        isSystemUser = true;

     

       
156
       
 
       
      };

     

       
157
       
+
       
    users.groups.docker-registry = {};

     

       
158
       
 
       
  };

     

       
159
       
 
       
}

     

···

       
187
       
 
       
    environment.systemPackages = [ pkgs.etcd ];

     

       
188
       
 
       


     

       
189
       
 
       
    users.users.etcd = {

     

       
190
       
-
       
      uid = config.ids.uids.etcd;

     

       
0
       
 
       

     

       
191
       
 
       
      description = "Etcd daemon user";

     

       
192
       
 
       
      home = cfg.dataDir;

     

       
193
       
 
       
    };

     

       
0
       
 
       

     

       
194
       
 
       
  };

     

       
195
       
 
       
}

     

···

       
187
       
 
       
    environment.systemPackages = [ pkgs.etcd ];

     

       
188
       
 
       


     

       
189
       
 
       
    users.users.etcd = {

     

       
190
       
+
       
      isSystemUser = true;

     

       
191
       
+
       
      group = "etcd";

     

       
192
       
 
       
      description = "Etcd daemon user";

     

       
193
       
 
       
      home = cfg.dataDir;

     

       
194
       
 
       
    };

     

       
195
       
+
       
    users.groups.etcd = {};

     

       
196
       
 
       
  };

     

       
197
       
 
       
}

     

···

       
38
       
 
       


     

       
39
       
 
       
    users.users.nix-ssh = {

     

       
40
       
 
       
      description = "Nix SSH store user";

     

       
41
       
-
       
      uid = config.ids.uids.nix-ssh;

     

       
0
       
 
       

     

       
42
       
 
       
      useDefaultShell = true;

     

       
43
       
 
       
    };

     

       
0
       
 
       

     

       
44
       
 
       


     

       
45
       
 
       
    services.openssh.enable = true;

     

       
46
       
 
       


     

···

       
38
       
 
       


     

       
39
       
 
       
    users.users.nix-ssh = {

     

       
40
       
 
       
      description = "Nix SSH store user";

     

       
41
       
+
       
      isSystemUser = true;

     

       
42
       
+
       
      group = "nix-ssh";

     

       
43
       
 
       
      useDefaultShell = true;

     

       
44
       
 
       
    };

     

       
45
       
+
       
    users.groups.nix-ssh = {};

     

       
46
       
 
       


     

       
47
       
 
       
    services.openssh.enable = true;

     

       
48
       
 
       


     

···

       
148
       
 
       
    };

     

       
149
       
 
       


     

       
150
       
 
       
    users.users.zookeeper = {

     

       
151
       
-
       
      uid = config.ids.uids.zookeeper;

     

       
0
       
 
       

     

       
152
       
 
       
      description = "Zookeeper daemon user";

     

       
153
       
 
       
      home = cfg.dataDir;

     

       
154
       
 
       
    };

     

       
0
       
 
       

     

       
155
       
 
       
  };

     

       
156
       
 
       
}

     

···

       
148
       
 
       
    };

     

       
149
       
 
       


     

       
150
       
 
       
    users.users.zookeeper = {

     

       
151
       
+
       
      isSystemUser = true;

     

       
152
       
+
       
      group = "zookeeper";

     

       
153
       
 
       
      description = "Zookeeper daemon user";

     

       
154
       
 
       
      home = cfg.dataDir;

     

       
155
       
 
       
    };

     

       
156
       
+
       
    users.groups.zookeeper = {};

     

       
157
       
 
       
  };

     

       
158
       
 
       
}

     

···

       
561
       
 
       
     ) {

     

       
562
       
 
       
      users.users.graphite = {

     

       
563
       
 
       
        uid = config.ids.uids.graphite;

     

       
0
       
 
       

     

       
564
       
 
       
        description = "Graphite daemon user";

     

       
565
       
 
       
        home = dataDir;

     

       
566
       
 
       
      };

     

···

       
561
       
 
       
     ) {

     

       
562
       
 
       
      users.users.graphite = {

     

       
563
       
 
       
        uid = config.ids.uids.graphite;

     

       
564
       
+
       
        group = "graphite";

     

       
565
       
 
       
        description = "Graphite daemon user";

     

       
566
       
 
       
        home = dataDir;

     

       
567
       
 
       
      };

     

···

       
258
       
 
       


     

       
259
       
 
       
    users.users = optionalAttrs (cfg.user == defaultUser) {

     

       
260
       
 
       
      ${defaultUser} = {

     

       
0
       
 
       

     

       
261
       
 
       
        isSystemUser = true;

     

       
262
       
 
       
      };

     

       
263
       
 
       
    };

     

···

       
258
       
 
       


     

       
259
       
 
       
    users.users = optionalAttrs (cfg.user == defaultUser) {

     

       
260
       
 
       
      ${defaultUser} = {

     

       
261
       
+
       
        group = defaultUser;

     

       
262
       
 
       
        isSystemUser = true;

     

       
263
       
 
       
      };

     

       
264
       
 
       
    };

     

···

       
36
       
 
       
      groups._tuptime.members = [ "_tuptime" ];

     

       
37
       
 
       
      users._tuptime = {

     

       
38
       
 
       
        isSystemUser = true;

     

       
0
       
 
       

     

       
39
       
 
       
        description = "tuptime database owner";

     

       
40
       
 
       
      };

     

       
41
       
 
       
    };

     

···

       
36
       
 
       
      groups._tuptime.members = [ "_tuptime" ];

     

       
37
       
 
       
      users._tuptime = {

     

       
38
       
 
       
        isSystemUser = true;

     

       
39
       
+
       
        group = "_tuptime";

     

       
40
       
 
       
        description = "tuptime database owner";

     

       
41
       
 
       
      };

     

       
42
       
 
       
    };

     

···

       
193
       
 
       
    environment.systemPackages = [ pkgs.orangefs ];

     

       
194
       
 
       


     

       
195
       
 
       
    # orangefs daemon will run as user

     

       
196
       
-
       
    users.users.orangefs.isSystemUser = true;

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
197
       
 
       
    users.groups.orangefs = {};

     

       
198
       
 
       


     

       
199
       
 
       
    # To format the file system the config file is needed.

     

···

       
193
       
 
       
    environment.systemPackages = [ pkgs.orangefs ];

     

       
194
       
 
       


     

       
195
       
 
       
    # orangefs daemon will run as user

     

       
196
       
+
       
    users.users.orangefs = {

     

       
197
       
+
       
      isSystemUser = true;

     

       
198
       
+
       
      group = "orangfs";

     

       
199
       
+
       
    };

     

       
200
       
 
       
    users.groups.orangefs = {};

     

       
201
       
 
       


     

       
202
       
 
       
    # To format the file system the config file is needed.

     

···

       
229
       
 
       


     

       
230
       
 
       
    users.users.${bindUser} =

     

       
231
       
 
       
      {

     

       
232
       
-
       
        uid = config.ids.uids.bind;

     

       
233
       
 
       
        description = "BIND daemon user";

     

       
0
       
 
       

     

       
234
       
 
       
      };

     

       
0
       
 
       

     

       
235
       
 
       


     

       
236
       
 
       
    systemd.services.bind = {

     

       
237
       
 
       
      description = "BIND Domain Name Server";

     

···

       
229
       
 
       


     

       
230
       
 
       
    users.users.${bindUser} =

     

       
231
       
 
       
      {

     

       
232
       
+
       
        group = bindUser;

     

       
233
       
 
       
        description = "BIND daemon user";

     

       
234
       
+
       
        isSystemUser = true;

     

       
235
       
 
       
      };

     

       
236
       
+
       
    users.groups.${bindUser} = {};

     

       
237
       
 
       


     

       
238
       
 
       
    systemd.services.bind = {

     

       
239
       
 
       
      description = "BIND Domain Name Server";

     

···

       
159
       
 
       


     

       
160
       
 
       
      users.users.consul = {

     

       
161
       
 
       
        description = "Consul agent daemon user";

     

       
162
       
-
       
        uid = config.ids.uids.consul;

     

       
0
       
 
       

     

       
163
       
 
       
        # The shell is needed for health checks

     

       
164
       
 
       
        shell = "/run/current-system/sw/bin/bash";

     

       
165
       
 
       
      };

     

       
0
       
 
       

     

       
166
       
 
       


     

       
167
       
 
       
      environment = {

     

       
168
       
 
       
        etc."consul.json".text = builtins.toJSON configOptions;

     

···

       
159
       
 
       


     

       
160
       
 
       
      users.users.consul = {

     

       
161
       
 
       
        description = "Consul agent daemon user";

     

       
162
       
+
       
        isSystemUser = true;

     

       
163
       
+
       
        group = "consul";

     

       
164
       
 
       
        # The shell is needed for health checks

     

       
165
       
 
       
        shell = "/run/current-system/sw/bin/bash";

     

       
166
       
 
       
      };

     

       
167
       
+
       
      users.groups.consul = {};

     

       
168
       
 
       


     

       
169
       
 
       
      environment = {

     

       
170
       
 
       
        etc."consul.json".text = builtins.toJSON configOptions;

     

···

       
311
       
 
       
    {

     

       
312
       
 
       
      users.users.turnserver =

     

       
313
       
 
       
        { uid = config.ids.uids.turnserver;

     

       
0
       
 
       

     

       
314
       
 
       
          description = "coturn TURN server user";

     

       
315
       
 
       
        };

     

       
316
       
 
       
      users.groups.turnserver =

     

···

       
311
       
 
       
    {

     

       
312
       
 
       
      users.users.turnserver =

     

       
313
       
 
       
        { uid = config.ids.uids.turnserver;

     

       
314
       
+
       
          group = "turnserver";

     

       
315
       
 
       
          description = "coturn TURN server user";

     

       
316
       
 
       
        };

     

       
317
       
 
       
      users.groups.turnserver =

     

···

       
212
       
 
       


     

       
213
       
 
       
    users = {

     

       
214
       
 
       
      users.dhcpd = {

     

       
215
       
-
       
        uid = config.ids.uids.dhcpd;

     

       
0
       
 
       

     

       
216
       
 
       
        description = "DHCP daemon user";

     

       
217
       
 
       
      };

     

       
0
       
 
       

     

       
218
       
 
       
    };

     

       
219
       
 
       


     

       
220
       
 
       
    systemd.services = dhcpdService "4" cfg4 // dhcpdService "6" cfg6;

     

···

       
212
       
 
       


     

       
213
       
 
       
    users = {

     

       
214
       
 
       
      users.dhcpd = {

     

       
215
       
+
       
        isSystemUser = true;

     

       
216
       
+
       
        group = "dhcpd";

     

       
217
       
 
       
        description = "DHCP daemon user";

     

       
218
       
 
       
      };

     

       
219
       
+
       
      groups.dhcpd = {};

     

       
220
       
 
       
    };

     

       
221
       
 
       


     

       
222
       
 
       
    systemd.services = dhcpdService "4" cfg4 // dhcpdService "6" cfg6;

     

···

       
87
       
 
       
    services.dbus.packages = [ dnsmasq ];

     

       
88
       
 
       


     

       
89
       
 
       
    users.users.dnsmasq = {

     

       
90
       
-
       
      uid = config.ids.uids.dnsmasq;

     

       
0
       
 
       

     

       
91
       
 
       
      description = "Dnsmasq daemon user";

     

       
92
       
 
       
    };

     

       
0
       
 
       

     

       
93
       
 
       


     

       
94
       
 
       
    networking.resolvconf = mkIf cfg.resolveLocalQueries {

     

       
95
       
 
       
      useLocalResolver = mkDefault true;

     

···

       
87
       
 
       
    services.dbus.packages = [ dnsmasq ];

     

       
88
       
 
       


     

       
89
       
 
       
    users.users.dnsmasq = {

     

       
90
       
+
       
      isSystemUser = true;

     

       
91
       
+
       
      group = "dnsmasq";

     

       
92
       
 
       
      description = "Dnsmasq daemon user";

     

       
93
       
 
       
    };

     

       
94
       
+
       
    users.groups.dnsmasq = {};

     

       
95
       
 
       


     

       
96
       
 
       
    networking.resolvconf = mkIf cfg.resolveLocalQueries {

     

       
97
       
 
       
      useLocalResolver = mkDefault true;

     

···

       
107
       
 
       
    users.users = optionalAttrs (cfg.user == "git") {

     

       
108
       
 
       
      git = {

     

       
109
       
 
       
        uid = config.ids.uids.git;

     

       
0
       
 
       

     

       
110
       
 
       
        description = "Git daemon user";

     

       
111
       
 
       
      };

     

       
112
       
 
       
    };

     

···

       
107
       
 
       
    users.users = optionalAttrs (cfg.user == "git") {

     

       
108
       
 
       
      git = {

     

       
109
       
 
       
        uid = config.ids.uids.git;

     

       
110
       
+
       
        group = "git";

     

       
111
       
 
       
        description = "Git daemon user";

     

       
112
       
 
       
      };

     

       
113
       
 
       
    };

     

···

       
190
       
 
       


     

       
191
       
 
       
    users.users.${iodinedUser} = {

     

       
192
       
 
       
      uid = config.ids.uids.iodined;

     

       
0
       
 
       

     

       
193
       
 
       
      description = "Iodine daemon user";

     

       
194
       
 
       
    };

     

       
195
       
 
       
    users.groups.iodined.gid = config.ids.gids.iodined;

     

···

       
190
       
 
       


     

       
191
       
 
       
    users.users.${iodinedUser} = {

     

       
192
       
 
       
      uid = config.ids.uids.iodined;

     

       
193
       
+
       
      group = "iodined";

     

       
194
       
 
       
      description = "Iodine daemon user";

     

       
195
       
 
       
    };

     

       
196
       
 
       
    users.groups.iodined.gid = config.ids.gids.iodined;

     

···

       
77
       
 
       
        createHome = true;

     

       
78
       
 
       
        home = "/var/lib/morty";

     

       
79
       
 
       
        isSystemUser = true;

     

       
0
       
 
       

     

       
80
       
 
       
      };

     

       
0
       
 
       

     

       
81
       
 
       


     

       
82
       
 
       
    systemd.services.morty =

     

       
83
       
 
       
      {

     

···

       
77
       
 
       
        createHome = true;

     

       
78
       
 
       
        home = "/var/lib/morty";

     

       
79
       
 
       
        isSystemUser = true;

     

       
80
       
+
       
        group = "morty";

     

       
81
       
 
       
      };

     

       
82
       
+
       
    users.groups.morty = {};

     

       
83
       
 
       


     

       
84
       
 
       
    systemd.services.morty =

     

       
85
       
 
       
      {

     

···

       
245
       
 
       


     

       
246
       
 
       
    users.users.ncdns = {

     

       
247
       
 
       
      isSystemUser = true;

     

       
0
       
 
       

     

       
248
       
 
       
      description = "ncdns daemon user";

     

       
249
       
 
       
    };

     

       
0
       
 
       

     

       
250
       
 
       


     

       
251
       
 
       
    systemd.services.ncdns = {

     

       
252
       
 
       
      description = "ncdns daemon";

     

···

       
245
       
 
       


     

       
246
       
 
       
    users.users.ncdns = {

     

       
247
       
 
       
      isSystemUser = true;

     

       
248
       
+
       
      group = "ncdns";

     

       
249
       
 
       
      description = "ncdns daemon user";

     

       
250
       
 
       
    };

     

       
251
       
+
       
    users.groups.ncdns = {};

     

       
252
       
 
       


     

       
253
       
 
       
    systemd.services.ncdns = {

     

       
254
       
 
       
      description = "ncdns daemon";

     

···

       
464
       
 
       
    users.users = {

     

       
465
       
 
       
      nm-openvpn = {

     

       
466
       
 
       
        uid = config.ids.uids.nm-openvpn;

     

       
0
       
 
       

     

       
467
       
 
       
        extraGroups = [ "networkmanager" ];

     

       
468
       
 
       
      };

     

       
469
       
 
       
      nm-iodine = {

     

···

       
464
       
 
       
    users.users = {

     

       
465
       
 
       
      nm-openvpn = {

     

       
466
       
 
       
        uid = config.ids.uids.nm-openvpn;

     

       
467
       
+
       
        group = "nm-openvpn";

     

       
468
       
 
       
        extraGroups = [ "networkmanager" ];

     

       
469
       
 
       
      };

     

       
470
       
 
       
      nm-iodine = {

     

···

       
52
       
 
       
    };

     

       
53
       
 
       


     

       
54
       
 
       
    users.users.ngircd = {

     

       
55
       
-
       
      uid = config.ids.uids.ngircd;

     

       
0
       
 
       

     

       
56
       
 
       
      description = "ngircd user.";

     

       
57
       
 
       
    };

     

       
0
       
 
       

     

       
0
       
 
       

     

       
58
       
 
       
  };

     

       
59
       
 
       
}

     

···

       
52
       
 
       
    };

     

       
53
       
 
       


     

       
54
       
 
       
    users.users.ngircd = {

     

       
55
       
+
       
      isSystemUser = true;

     

       
56
       
+
       
      group = "ngircd";

     

       
57
       
 
       
      description = "ngircd user.";

     

       
58
       
 
       
    };

     

       
59
       
+
       
    users.groups.ngircd = {};

     

       
60
       
+
       


     

       
61
       
 
       
  };

     

       
62
       
 
       
}

     

···

       
74
       
 
       
      users."${cfg.user}" = {

     

       
75
       
 
       
        description = "Pleroma user";

     

       
76
       
 
       
        home = cfg.stateDir;

     

       
77
       
-
       
        extraGroups = [ cfg.group ];

     

       
78
       
 
       
        isSystemUser = true;

     

       
79
       
 
       
      };

     

       
80
       
 
       
      groups."${cfg.group}" = {};

     

···

       
74
       
 
       
      users."${cfg.user}" = {

     

       
75
       
 
       
        description = "Pleroma user";

     

       
76
       
 
       
        home = cfg.stateDir;

     

       
77
       
+
       
        group = cfg.group;

     

       
78
       
 
       
        isSystemUser = true;

     

       
79
       
 
       
      };

     

       
80
       
 
       
      groups."${cfg.group}" = {};

     

···

       
140
       
 
       


     

       
141
       
 
       
    environment.systemPackages = [ pkg ];

     

       
142
       
 
       


     

       
143
       
-
       
    users.users.radicale.uid = config.ids.uids.radicale;

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
144
       
 
       


     

       
145
       
-
       
    users.groups.radicale.gid = config.ids.gids.radicale;

     

       
146
       
 
       


     

       
147
       
 
       
    systemd.services.radicale = {

     

       
148
       
 
       
      description = "A Simple Calendar and Contact Server";

     

···

       
140
       
 
       


     

       
141
       
 
       
    environment.systemPackages = [ pkg ];

     

       
142
       
 
       


     

       
143
       
+
       
    users.users.radicale = {

     

       
144
       
+
       
      isSystemUser = true;

     

       
145
       
+
       
      group = "radicale";

     

       
146
       
+
       
    };

     

       
147
       
 
       


     

       
148
       
+
       
    users.groups.radicale = {};

     

       
149
       
 
       


     

       
150
       
 
       
    systemd.services.radicale = {

     

       
151
       
 
       
      description = "A Simple Calendar and Contact Server";

     

···

       
55
       
 
       
  config = mkIf cfg.enable {

     

       
56
       
 
       


     

       
57
       
 
       
    users.users.radvd =

     

       
58
       
-
       
      { uid = config.ids.uids.radvd;

     

       
0
       
 
       

     

       
0
       
 
       

     

       
59
       
 
       
        description = "Router Advertisement Daemon User";

     

       
60
       
 
       
      };

     

       
0
       
 
       

     

       
61
       
 
       


     

       
62
       
 
       
    systemd.services.radvd =

     

       
63
       
 
       
      { description = "IPv6 Router Advertisement Daemon";

     

···

       
55
       
 
       
  config = mkIf cfg.enable {

     

       
56
       
 
       


     

       
57
       
 
       
    users.users.radvd =

     

       
58
       
+
       
      {

     

       
59
       
+
       
        isSystemUser = true;

     

       
60
       
+
       
        group = "radvd";

     

       
61
       
 
       
        description = "Router Advertisement Daemon User";

     

       
62
       
 
       
      };

     

       
63
       
+
       
    users.groups.radvd = {};

     

       
64
       
 
       


     

       
65
       
 
       
    systemd.services.radvd =

     

       
66
       
 
       
      { description = "IPv6 Router Advertisement Daemon";

     

···

       
259
       
 
       
      user = mkOption {

     

       
260
       
 
       
        type = types.str;

     

       
261
       
 
       
        default = "smokeping";

     

       
262
       
-
       
        description = "User that runs smokeping and (optionally) thttpd";

     

       
263
       
 
       
      };

     

       
264
       
 
       
      webService = mkOption {

     

       
265
       
 
       
        type = types.bool;

     
···

       
285
       
 
       
    users.users.${cfg.user} = {

     

       
286
       
 
       
      isNormalUser = false;

     

       
287
       
 
       
      isSystemUser = true;

     

       
288
       
-
       
      uid = config.ids.uids.smokeping;

     

       
289
       
 
       
      description = "smokeping daemon user";

     

       
290
       
 
       
      home = smokepingHome;

     

       
291
       
 
       
      createHome = true;

     

       
292
       
 
       
    };

     

       
0
       
 
       

     

       
293
       
 
       
    systemd.services.smokeping = {

     

       
294
       
 
       
      wantedBy = [ "multi-user.target"];

     

       
295
       
 
       
      serviceConfig = {

     

···

       
259
       
 
       
      user = mkOption {

     

       
260
       
 
       
        type = types.str;

     

       
261
       
 
       
        default = "smokeping";

     

       
262
       
+
       
        description = "User that runs smokeping and (optionally) thttpd. A group of the same name will be created as well.";

     

       
263
       
 
       
      };

     

       
264
       
 
       
      webService = mkOption {

     

       
265
       
 
       
        type = types.bool;

     
···

       
285
       
 
       
    users.users.${cfg.user} = {

     

       
286
       
 
       
      isNormalUser = false;

     

       
287
       
 
       
      isSystemUser = true;

     

       
288
       
+
       
      group = cfg.user;

     

       
289
       
 
       
      description = "smokeping daemon user";

     

       
290
       
 
       
      home = smokepingHome;

     

       
291
       
 
       
      createHome = true;

     

       
292
       
 
       
    };

     

       
293
       
+
       
    users.groups.${cfg.user} = {};

     

       
294
       
 
       
    systemd.services.smokeping = {

     

       
295
       
 
       
      wantedBy = [ "multi-user.target"];

     

       
296
       
 
       
      serviceConfig = {

     

···

       
401
       
 
       
  config = mkIf cfg.enable {

     

       
402
       
 
       


     

       
403
       
 
       
    users.users.sshd =

     

       
404
       
-
       
      { isSystemUser = true;

     

       
0
       
 
       

     

       
0
       
 
       

     

       
405
       
 
       
        description = "SSH privilege separation user";

     

       
406
       
 
       
      };

     

       
0
       
 
       

     

       
407
       
 
       


     

       
408
       
 
       
    services.openssh.moduliFile = mkDefault "${cfgc.package}/etc/ssh/moduli";

     

       
409
       
 
       
    services.openssh.sftpServerExecutable = mkDefault "${cfgc.package}/libexec/sftp-server";

     

···

       
401
       
 
       
  config = mkIf cfg.enable {

     

       
402
       
 
       


     

       
403
       
 
       
    users.users.sshd =

     

       
404
       
+
       
      {

     

       
405
       
+
       
        isSystemUser = true;

     

       
406
       
+
       
        group = "sshd";

     

       
407
       
 
       
        description = "SSH privilege separation user";

     

       
408
       
 
       
      };

     

       
409
       
+
       
    users.groups.sshd = {};

     

       
410
       
 
       


     

       
411
       
 
       
    services.openssh.moduliFile = mkDefault "${cfgc.package}/etc/ssh/moduli";

     

       
412
       
 
       
    services.openssh.sftpServerExecutable = mkDefault "${cfgc.package}/libexec/sftp-server";

     

···

       
32
       
 
       
  config = mkIf config.services.tinydns.enable {

     

       
33
       
 
       
    environment.systemPackages = [ pkgs.djbdns ];

     

       
34
       
 
       


     

       
35
       
-
       
    users.users.tinydns.isSystemUser = true;

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
36
       
 
       


     

       
37
       
 
       
    systemd.services.tinydns = {

     

       
38
       
 
       
      description = "djbdns tinydns server";

     

···

       
32
       
 
       
  config = mkIf config.services.tinydns.enable {

     

       
33
       
 
       
    environment.systemPackages = [ pkgs.djbdns ];

     

       
34
       
 
       


     

       
35
       
+
       
    users.users.tinydns = {

     

       
36
       
+
       
      isSystemUser = true;

     

       
37
       
+
       
      group = "tinydns";

     

       
38
       
+
       
    };

     

       
39
       
+
       
    users.groups.tinydns = {};

     

       
40
       
 
       


     

       
41
       
 
       
    systemd.services.tinydns = {

     

       
42
       
 
       
      description = "djbdns tinydns server";

     

···

       
58
       
 
       
    security.pam.services.atd = {};

     

       
59
       
 
       


     

       
60
       
 
       
    users.users.atd =

     

       
61
       
-
       
      { uid = config.ids.uids.atd;

     

       
0
       
 
       

     

       
0
       
 
       

     

       
62
       
 
       
        description = "atd user";

     

       
63
       
 
       
        home = "/var/empty";

     

       
64
       
 
       
      };

     

···

       
58
       
 
       
    security.pam.services.atd = {};

     

       
59
       
 
       


     

       
60
       
 
       
    users.users.atd =

     

       
61
       
+
       
      {

     

       
62
       
+
       
        uid = config.ids.uids.atd;

     

       
63
       
+
       
        group = "atd";

     

       
64
       
 
       
        description = "atd user";

     

       
65
       
 
       
        home = "/var/empty";

     

       
66
       
 
       
      };

     

···

       
199
       
 
       
    environment.systemPackages = [ cfg.package ];

     

       
200
       
 
       


     

       
201
       
 
       
    users.users.kibana = {

     

       
202
       
-
       
      uid = config.ids.uids.kibana;

     

       
203
       
 
       
      description = "Kibana service user";

     

       
204
       
 
       
      home = cfg.dataDir;

     

       
205
       
 
       
      createHome = true;

     

       
0
       
 
       

     

       
206
       
 
       
    };

     

       
0
       
 
       

     

       
207
       
 
       
  };

     

       
208
       
 
       
}

     

···

       
199
       
 
       
    environment.systemPackages = [ cfg.package ];

     

       
200
       
 
       


     

       
201
       
 
       
    users.users.kibana = {

     

       
202
       
+
       
      isSystemUser = true;

     

       
203
       
 
       
      description = "Kibana service user";

     

       
204
       
 
       
      home = cfg.dataDir;

     

       
205
       
 
       
      createHome = true;

     

       
206
       
+
       
      group = "kibana";

     

       
207
       
 
       
    };

     

       
208
       
+
       
    users.groups.kibana = {};

     

       
209
       
 
       
  };

     

       
210
       
 
       
}

     

···

       
82
       
 
       


     

       
83
       
 
       
    users.users.hockeypuck = {

     

       
84
       
 
       
      isSystemUser = true;

     

       
0
       
 
       

     

       
85
       
 
       
      description = "Hockeypuck user";

     

       
86
       
 
       
    };

     

       
0
       
 
       

     

       
87
       
 
       


     

       
88
       
 
       
    systemd.services.hockeypuck = {

     

       
89
       
 
       
      description = "Hockeypuck OpenPGP Key Server";

     

···

       
82
       
 
       


     

       
83
       
 
       
    users.users.hockeypuck = {

     

       
84
       
 
       
      isSystemUser = true;

     

       
85
       
+
       
      group = "hockeypuck";

     

       
86
       
 
       
      description = "Hockeypuck user";

     

       
87
       
 
       
    };

     

       
88
       
+
       
    users.groups.hockeypuck = {};

     

       
89
       
 
       


     

       
90
       
 
       
    systemd.services.hockeypuck = {

     

       
91
       
 
       
      description = "Hockeypuck OpenPGP Key Server";

     

···

       
172
       
 
       


     

       
173
       
 
       
    users.users.magnetico = {

     

       
174
       
 
       
      description = "Magnetico daemons user";

     

       
0
       
 
       

     

       
175
       
 
       
      isSystemUser = true;

     

       
176
       
 
       
    };

     

       
0
       
 
       

     

       
177
       
 
       


     

       
178
       
 
       
    systemd.services.magneticod = {

     

       
179
       
 
       
      description = "Magnetico DHT crawler";

     

···

       
172
       
 
       


     

       
173
       
 
       
    users.users.magnetico = {

     

       
174
       
 
       
      description = "Magnetico daemons user";

     

       
175
       
+
       
      group = "magnetico";

     

       
176
       
 
       
      isSystemUser = true;

     

       
177
       
 
       
    };

     

       
178
       
+
       
    users.groups.magnetico = {};

     

       
179
       
 
       


     

       
180
       
 
       
    systemd.services.magneticod = {

     

       
181
       
 
       
      description = "Magnetico DHT crawler";

     

···

       
60
       
 
       
      };

     

       
61
       
 
       
    };

     

       
62
       
 
       


     

       
63
       
-
       
    users.users.peerflix.uid = config.ids.uids.peerflix;

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
64
       
 
       
  };

     

       
65
       
 
       
}

     

···

       
60
       
 
       
      };

     

       
61
       
 
       
    };

     

       
62
       
 
       


     

       
63
       
+
       
    users.users.peerflix = {

     

       
64
       
+
       
      isSystemUser = true;

     

       
65
       
+
       
      group = "peerflix";

     

       
66
       
+
       
    };

     

       
67
       
+
       
    users.groups.peerflix = {};

     

       
68
       
 
       
  };

     

       
69
       
 
       
}

     

···

       
114
       
 
       
    users.users = optionalAttrs (cfg.user == defaultUser) {

     

       
115
       
 
       
      ${defaultUser} = {

     

       
116
       
 
       
        isSystemUser = true;

     

       
0
       
 
       

     

       
117
       
 
       
      };

     

       
118
       
 
       
    };

     

       
119
       
 
       


     

···

       
114
       
 
       
    users.users = optionalAttrs (cfg.user == defaultUser) {

     

       
115
       
 
       
      ${defaultUser} = {

     

       
116
       
 
       
        isSystemUser = true;

     

       
117
       
+
       
        group = defaultUser;

     

       
118
       
 
       
      };

     

       
119
       
 
       
    };

     

       
120
       
 
       


     

···

       
1056
       
 
       


     

       
1057
       
 
       
    services.dbus.enable = true;

     

       
1058
       
 
       


     

       
1059
       
-
       
    users.users.systemd-coredump.uid = config.ids.uids.systemd-coredump;

     

       
1060
       
-
       
    users.users.systemd-network.uid = config.ids.uids.systemd-network;

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
1061
       
 
       
    users.groups.systemd-network.gid = config.ids.gids.systemd-network;

     

       
1062
       
-
       
    users.users.systemd-resolve.uid = config.ids.uids.systemd-resolve;

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
1063
       
 
       
    users.groups.systemd-resolve.gid = config.ids.gids.systemd-resolve;

     

       
1064
       
 
       


     

       
1065
       
 
       
    # Target for ‘charon send-keys’ to hook into.

     

···

       
1056
       
 
       


     

       
1057
       
 
       
    services.dbus.enable = true;

     

       
1058
       
 
       


     

       
1059
       
+
       
    users.users.systemd-coredump = {

     

       
1060
       
+
       
      uid = config.ids.uids.systemd-coredump;

     

       
1061
       
+
       
      group = "systemd-coredump";

     

       
1062
       
+
       
    };

     

       
1063
       
+
       
    users.users.systemd-network = {

     

       
1064
       
+
       
      uid = config.ids.uids.systemd-network;

     

       
1065
       
+
       
      group = "systemd-network";

     

       
1066
       
+
       
    };

     

       
1067
       
 
       
    users.groups.systemd-network.gid = config.ids.gids.systemd-network;

     

       
1068
       
+
       
    users.users.systemd-resolve = {

     

       
1069
       
+
       
      uid = config.ids.uids.systemd-resolve;

     

       
1070
       
+
       
      group = "systemd-resolve";

     

       
1071
       
+
       
    };

     

       
1072
       
 
       
    users.groups.systemd-resolve.gid = config.ids.gids.systemd-resolve;

     

       
1073
       
 
       


     

       
1074
       
 
       
    # Target for ‘charon send-keys’ to hook into.

     

···

       
158
       
 
       
      };

     

       
159
       
 
       
    };

     

       
160
       
 
       


     

       
161
       
-
       
    users.groups.lxd.gid = config.ids.gids.lxd;

     

       
162
       
 
       


     

       
163
       
 
       
    users.users.root = {

     

       
164
       
 
       
      subUidRanges = [ { startUid = 1000000; count = 65536; } ];

     

···

       
158
       
 
       
      };

     

       
159
       
 
       
    };

     

       
160
       
 
       


     

       
161
       
+
       
    users.groups.lxd = {};

     

       
162
       
 
       


     

       
163
       
 
       
    users.users.root = {

     

       
164
       
 
       
      subUidRanges = [ { startUid = 1000000; count = 65536; } ];

     

···

       
145
       
 
       
          # user that is permitted to access the unix socket

     

       
146
       
 
       
          someuser = {

     

       
147
       
 
       
            isSystemUser = true;

     

       
0
       
 
       

     

       
148
       
 
       
            extraGroups = [

     

       
149
       
 
       
              config.users.users.unbound.group

     

       
150
       
 
       
            ];

     

       
151
       
 
       
          };

     

       
152
       
 
       


     

       
153
       
 
       
          # user that is not permitted to access the unix socket

     

       
154
       
-
       
          unauthorizeduser = { isSystemUser = true; };

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
155
       
 
       
        };

     

       
156
       
 
       


     

       
157
       
 
       
        # Used for testing configuration reloading

     

···

       
145
       
 
       
          # user that is permitted to access the unix socket

     

       
146
       
 
       
          someuser = {

     

       
147
       
 
       
            isSystemUser = true;

     

       
148
       
+
       
            group = "someuser";

     

       
149
       
 
       
            extraGroups = [

     

       
150
       
 
       
              config.users.users.unbound.group

     

       
151
       
 
       
            ];

     

       
152
       
 
       
          };

     

       
153
       
 
       


     

       
154
       
 
       
          # user that is not permitted to access the unix socket

     

       
155
       
+
       
          unauthorizeduser = {

     

       
156
       
+
       
            isSystemUser = true;

     

       
157
       
+
       
            group = "unauthorizeduser";

     

       
158
       
+
       
          };

     

       
159
       
+
       


     

       
160
       
+
       
        };

     

       
161
       
+
       
        users.groups = {

     

       
162
       
+
       
          someuser = {};

     

       
163
       
+
       
          unauthorizeduser = {};

     

       
164
       
 
       
        };

     

       
165
       
 
       


     

       
166
       
 
       
        # Used for testing configuration reloading