Run all nixng containers under particular user/group

nixng-modules/bazarr.nix

@@ -1,29 +1,48 @@
 {
   lib,
+  nglib,
   config,
   pkgs,
   ...
 }: let
   cfg = config.services.bazarr;
+  cfgInit = config.init.services.bazarr;
 in {
   options.services.bazarr = {
     enable = lib.mkEnableOption "bazarr";
     package = lib.mkPackageOption pkgs "bazarr" {};
+
     configDir = lib.mkOption {
       description = "Where Bazarr's configuration files are stored.";
       type = lib.types.str;
       default = "/config";
     };
   };
+
   config = lib.mkIf cfg.enable {
     init.services.bazarr = {
       enabled = true;
+      user = lib.mkDefault "bazarr";
+      group = lib.mkDefault "bazarr";
+
       script = pkgs.writeShellScript "bazarr-run" ''
         ${lib.getExe cfg.package} \
           --no-update \
           --config '${cfg.configDir}'
       '';
     };
+
     environment.systemPackages = [cfg.package];
+
+    users.users.${cfgInit.user} = nglib.mkDefaultRec {
+      description = "bazarr";
+      group = cfgInit.group;
+      createHome = false;
+      home = "/var/empty";
+      useDefaultShell = true;
+      uid = config.ids.uids.bazarr;
+    };
+
+    users.groups.${cfgInit.group} = nglib.mkDefaultRec {gid = config.ids.gids.bazarr;};
   };
 }