Run all nixng containers under particular user/group

nixng-modules/radarr.nix

@@ -1,10 +1,12 @@
 {
   config,
   lib,
+  nglib,
   pkgs,
   ...
 }: let
   cfg = config.services.radarr;
+  cfgInit = config.init.services.radarr;
 in {
   options.services.radarr = {
     enable = lib.mkEnableOption "radarr";
@@ -20,6 +22,8 @@ in {
   config = lib.mkIf cfg.enable {
     init.services.radarr = {
       enabled = true;
+      user = lib.mkDefault "radarr";
+      group = lib.mkDefault "radarr";
 
       script = pkgs.writeShellScript "radarr-run.sh" ''
         ${lib.getExe cfg.package} -nobrowser -data='${cfg.dataDir}'
@@ -27,5 +31,16 @@ in {
     };
 
     environment.systemPackages = [cfg.package];
+
+    users.users.${cfgInit.user} = nglib.mkDefaultRec {
+      description = "radarr";
+      group = cfgInit.group;
+      createHome = false;
+      home = "/var/empty";
+      useDefaultShell = true;
+      uid = config.ids.uids.radarr;
+    };
+
+    users.groups.${cfgInit.group} = nglib.mkDefaultRec {gid = config.ids.gids.radarr;};
   };
 }