nixos/nebula-lighthouse-service: run as lower privilege user

}:

let

  inherit (lib) types;

  cfg = config.services.nebula-lighthouse-service;

  settingsFormat = pkgs.formats.yaml { };

in

  options.services.nebula-lighthouse-service = {

    enable = lib.mkEnableOption "nebula-lighthouse-service";

    user = lib.mkOption {

      type = types.str;

      default = "nebula-lighthouse";

      description = ''

        The user and group to run nebula-lighthouse-service as.

      '';

      example = "nebula-lighthouse";

    };

    settings = lib.mkOption {

      type = settingsFormat.type;

      default = { };

        Restart = "always";

        ExecStart = "${pkgs.nebula-lighthouse-service}/bin/nebula-lighthouse-service";

        StateDirectory = "nebula-lighthouse-service";

        User = cfg.user;

        Group = cfg.user;

      };

    };

    users.users.${cfg.user} = {

      group = cfg.user;

      description = "nebula-lighthouse-service user";

      isSystemUser = true;

    };

    users.groups.${cfg.user} = { };

  };

  meta.maintainers = with lib.maintainers; [

    bloominstrong