Run all nixng containers under particular user/group

modules/media.nix

@@ -186,7 +186,8 @@
               };
 
               securityContext = {
-                fsGroup = 0;
+                # TODO: don't hardcode this
+                fsGroup = 409;
                 fsGroupChangePolicy = "OnRootMismatch";
               };
             };
@@ -244,7 +245,7 @@
               };
 
               securityContext = {
-                fsGroup = 1000;
+                fsGroup = 410;
                 fsGroupChangePolicy = "OnRootMismatch";
               };
             };
@@ -295,7 +296,7 @@
               };
 
               securityContext = {
-                fsGroup = 1000;
+                fsGroup = 413;
                 fsGroupChangePolicy = "OnRootMismatch";
               };
             };
@@ -353,7 +354,7 @@
               };
 
               securityContext = {
-                fsGroup = 1000;
+                fsGroup = 411;
                 fsGroupChangePolicy = "OnRootMismatch";
               };
             };
@@ -411,7 +412,7 @@
               };
 
               securityContext = {
-                fsGroup = 1000;
+                fsGroup = 412;
                 fsGroupChangePolicy = "OnRootMismatch";
               };
             };

nixng-configurations/default.nix

@@ -36,6 +36,7 @@ in {
       };
 
       extraModules = [
+        self.nixngModules.ids
         self.nixngModules.bazarr
         self.nixngModules.radicale
         self.nixngModules.jellyseerr

nixng-modules/bazarr.nix

@@ -1,29 +1,48 @@
 {
   lib,
+  nglib,
   config,
   pkgs,
   ...
 }: let
   cfg = config.services.bazarr;
+  cfgInit = config.init.services.bazarr;
 in {
   options.services.bazarr = {
     enable = lib.mkEnableOption "bazarr";
     package = lib.mkPackageOption pkgs "bazarr" {};
+
     configDir = lib.mkOption {
       description = "Where Bazarr's configuration files are stored.";
       type = lib.types.str;
       default = "/config";
     };
   };
+
   config = lib.mkIf cfg.enable {
     init.services.bazarr = {
       enabled = true;
+      user = lib.mkDefault "bazarr";
+      group = lib.mkDefault "bazarr";
+
       script = pkgs.writeShellScript "bazarr-run" ''
         ${lib.getExe cfg.package} \
           --no-update \
           --config '${cfg.configDir}'
       '';
     };
+
     environment.systemPackages = [cfg.package];
+
+    users.users.${cfgInit.user} = nglib.mkDefaultRec {
+      description = "bazarr";
+      group = cfgInit.group;
+      createHome = false;
+      home = "/var/empty";
+      useDefaultShell = true;
+      uid = config.ids.uids.bazarr;
+    };
+
+    users.groups.${cfgInit.group} = nglib.mkDefaultRec {gid = config.ids.gids.bazarr;};
   };
 }

nixng-modules/default.nix

@@ -6,5 +6,6 @@
     radarr = import ./radarr.nix;
     sonarr = import ./sonarr.nix;
     prowlarr = import ./prowlarr.nix;
+    ids = import ./ids.nix;
   };
 }

nixng-modules/ids.nix

@@ -0,0 +1,21 @@
+{...}: {
+  ids = {
+    uids = {
+      radicale = 408;
+      jellyseerr = 409;
+      radarr = 410;
+      sonarr = 411;
+      bazarr = 412;
+      prowlarr = 413;
+    };
+
+    gids = {
+      radicale = 408;
+      jellyseerr = 409;
+      radarr = 410;
+      sonarr = 411;
+      bazarr = 412;
+      prowlarr = 413;
+    };
+  };
+}

nixng-modules/jellyseerr.nix

@@ -1,10 +1,12 @@
 {
   lib,
+  nglib,
   pkgs,
   config,
   ...
 }: let
   cfg = config.services.jellyseerr;
+  cfgInit = config.init.services.jellyseerr;
 in {
   options.services.jellyseerr = {
     enable = lib.mkEnableOption "jellyseerr";
@@ -33,14 +35,28 @@ in {
     init.services.jellyseerr = {
       enabled = true;
       script = lib.getExe cfg.package;
+      user = lib.mkDefault "jellyseerr";
+      group = lib.mkDefault "jellyseerr";
     };
 
     environment = {
       systemPackages = [cfg.package];
+
       variables = {
         PORT = builtins.toString cfg.port;
         CONFIG_DIRECTORY = cfg.configDir;
       };
     };
+
+    users.users.${cfgInit.user} = nglib.mkDefaultRec {
+      description = "jellyseerr";
+      group = cfgInit.group;
+      createHome = false;
+      home = "/var/empty";
+      useDefaultShell = true;
+      uid = config.ids.uids.jellyseerr;
+    };
+
+    users.groups.${cfgInit.group} = nglib.mkDefaultRec {gid = config.ids.gids.jellyseerr;};
   };
 }

nixng-modules/prowlarr.nix

@@ -1,10 +1,12 @@
 {
   pkgs,
   lib,
+  nglib,
   config,
   ...
 }: let
   cfg = config.services.prowlarr;
+  cfgInit = config.init.services.prowlarr;
 in {
   options.services.prowlarr = {
     enable = lib.mkEnableOption "prowlarr";
@@ -20,6 +22,8 @@ in {
   config = lib.mkIf cfg.enable {
     init.services.prowlarr = {
       enabled = true;
+      user = lib.mkDefault "prowlarr";
+      group = lib.mkDefault "prowlarr";
 
       script = pkgs.writeShellScript "prowlarr-run" ''
         ${lib.getExe cfg.package} \
@@ -29,5 +33,16 @@ in {
     };
 
     environment.systemPackages = [cfg.package];
+
+    users.users.${cfgInit.user} = nglib.mkDefaultRec {
+      description = "prowlarr";
+      group = cfgInit.group;
+      createHome = false;
+      home = "/var/empty";
+      useDefaultShell = true;
+      uid = config.ids.uids.prowlarr;
+    };
+
+    users.groups.${cfgInit.group} = nglib.mkDefaultRec {gid = config.ids.gids.prowlarr;};
   };
 }

nixng-modules/radarr.nix

@@ -1,10 +1,12 @@
 {
   config,
   lib,
+  nglib,
   pkgs,
   ...
 }: let
   cfg = config.services.radarr;
+  cfgInit = config.init.services.radarr;
 in {
   options.services.radarr = {
     enable = lib.mkEnableOption "radarr";
@@ -20,6 +22,8 @@ in {
   config = lib.mkIf cfg.enable {
     init.services.radarr = {
       enabled = true;
+      user = lib.mkDefault "radarr";
+      group = lib.mkDefault "radarr";
 
       script = pkgs.writeShellScript "radarr-run.sh" ''
         ${lib.getExe cfg.package} -nobrowser -data='${cfg.dataDir}'
@@ -27,5 +31,16 @@ in {
     };
 
     environment.systemPackages = [cfg.package];
+
+    users.users.${cfgInit.user} = nglib.mkDefaultRec {
+      description = "radarr";
+      group = cfgInit.group;
+      createHome = false;
+      home = "/var/empty";
+      useDefaultShell = true;
+      uid = config.ids.uids.radarr;
+    };
+
+    users.groups.${cfgInit.group} = nglib.mkDefaultRec {gid = config.ids.gids.radarr;};
   };
 }

nixng-modules/radicale.nix

@@ -6,6 +6,7 @@
   ...
 }: let
   cfg = config.services.radicale;
+  cfgInit = config.init.services.radicale;
 
   settingsFormat = pkgs.formats.ini {
     listToValue = lib.concatMapStringsSep ", " (lib.generators.mkValueStringDefault {});
@@ -14,23 +15,16 @@ in {
   options.services.radicale = {
     enable = lib.mkEnableOption "radicale";
     package = lib.mkPackageOption pkgs "radicale" {};
-    user = lib.mkOption {
-      description = "radicale user";
-      type = lib.types.str;
-      default = "radicale";
-    };
-    group = lib.mkOption {
-      description = "radicale group";
-      type = lib.types.str;
-      default = "radicale";
-    };
+
     settings = lib.mkOption {
       type = settingsFormat.type;
       default = {};
+
       description = ''
         Configuration for Radicale. See
         <https://radicale.org/v3.html#configuration>.
       '';
+
       example = lib.literalExpression ''
         server = {
           hosts = [ "0.0.0.0:5232" "[::]:5232" ];
@@ -46,6 +40,7 @@ in {
       '';
     };
   };
+
   config = lib.mkIf cfg.enable (let
     configFile = settingsFormat.generate "radicale.ini" cfg.settings;
   in {
@@ -62,20 +57,15 @@ in {
 
     environment.systemPackages = [cfg.package];
 
-    users.users.${cfg.user} = nglib.mkDefaultRec {
+    users.users.${cfgInit.user} = nglib.mkDefaultRec {
       description = "radicale";
-      group = cfg.group;
+      group = cfgInit.group;
       createHome = false;
       home = "/var/empty";
       useDefaultShell = true;
       uid = config.ids.uids.radicale;
     };
 
-    users.groups.${cfg.group} = nglib.mkDefaultRec {gid = config.ids.gids.radicale;};
-
-    ids = {
-      uids.radicale = 408;
-      gids.radicale = 408;
-    };
+    users.groups.${cfgInit.group} = nglib.mkDefaultRec {gid = config.ids.gids.radicale;};
   });
 }

nixng-modules/sonarr.nix

@@ -1,10 +1,12 @@
 {
   lib,
+  nglib,
   config,
   pkgs,
   ...
 }: let
   cfg = config.services.sonarr;
+  cfgInit = config.init.services.sonarr;
 in {
   options.services.sonarr = {
     enable = lib.mkEnableOption "sonarr";
@@ -20,6 +22,8 @@ in {
   config = lib.mkIf cfg.enable {
     init.services.sonarr = {
       enabled = true;
+      user = lib.mkDefault "sonarr";
+      group = lib.mkDefault "sonarr";
 
       script = pkgs.writeShellScript "sonarr-run" ''
         ${lib.getExe cfg.package} -nobrowser -data=${cfg.dataDir}
@@ -27,5 +31,16 @@ in {
     };
 
     environment.systemPackages = [cfg.package];
+
+    users.users.${cfgInit.user} = nglib.mkDefaultRec {
+      description = "sonarr";
+      group = cfgInit.group;
+      createHome = false;
+      home = "/var/empty";
+      useDefaultShell = true;
+      uid = config.ids.uids.sonarr;
+    };
+
+    users.groups.${cfgInit.group} = nglib.mkDefaultRec {gid = config.ids.gids.sonarr;};
   };
 }