[mcp] Adds back the user changes I accidentally clobbered.

system/hosts/mcp/containers.nix

@@ -18,6 +18,7 @@
     ./containers/shared-postgres.nix
     ./containers/synapse.nix
     ./containers/traefik.nix
+    ./containers/users.nix
   ];
 
   # Enable common container config files in /etc/containers
@@ -44,26 +45,6 @@
     #podman-compose # start group of containers for dev
   ];
 
-  users.groups = {
-    git = { };
-    timetagger = { };
-  };
-  users.users = {
-    gitea = {
-      uid = 2001;
-      isSystemUser = true;
-      description = "System User for Gitea";
-      extraGroups = [ "git" ];
-      group = "git";
-    };
-    timetagger = {
-      uid = 2002;
-      isSystemUser = true;
-      description = "System User for TimeTagger";
-      group = "timetagger";
-    };
-  };
-
   virtualisation.oci-containers.backend = "podman";
   virtualisation.oci-containers.containers =
     let

system/hosts/mcp/containers/bookstack.nix

@@ -1,29 +1,17 @@
 { config, ... }:
 let 
   inherit (import ./lib.nix config) mkContainer mkMariaDbContainer havenisms;
-  userIds = import ./user-ids.nix;
 in {
   imports = [
     (mkMariaDbContainer {
       name = "bookstack";
-      uid = userIds.bookstack.uid;
+      uid = config.users.users.bookstack.uid;
-      gid = userIds.bookstack.gid;
+      gid = config.users.groups.bookstack.gid;
       directory = "/tank/bookstack/db";
       passwordSecret = "bookstack_db";
     })
   ];
 
-  users.groups.bookstack = {
-    gid = userIds.bookstack.gid;
-  };
-
-  users.users.bookstack = {
-    uid = userIds.bookstack.uid;
-    isSystemUser = true;
-    description = "System User for Bookstack";
-    group = "bookstack";
-  };
-
   sops.secrets = {
     bookstack_app_key = {
       restartUnits = [ "podman-bookstack.service" ];
@@ -55,8 +43,8 @@ in {
     ];
     environment = {
       APP_URL = "https://bookstack.${havenisms}";
-      PID = toString userIds.bookstack.uid;
+      PID = toString config.users.users.bookstack.uid;
-      GID = toString userIds.bookstack.gid;
+      GID = toString config.users.groups.bookstack.gid;
       DB_HOST = "bookstack-mariadb";
       DB_USERNAME = "bookstack";
       DB_DATABASE = "bookstack";

system/hosts/mcp/containers/focalboard.nix

@@ -1,30 +1,17 @@
 { config, ... }:
 let
   inherit (import ./lib.nix config) mkContainer mkPostgresContainer terakoda;
-  userIds = import ./user-ids.nix;
-  
 in {
   imports = [
     (mkPostgresContainer {
       name = "focalboard";
       directory = "/tank/focalboard/db";
-      uid = userIds.focalboard.uid;
+      uid = config.users.users.focalboard.uid;
-      gid = userIds.focalboard.gid;
+      gid = config.users.groups.focalboard.gid;
       passwordSecret = "focalboard/database";
     })
   ];
 
-  users.groups.focalboard = {
-    gid = userIds.focalboard.gid;
-  };
-
-  users.users.focalboard = {
-    uid = userIds.focalboard.uid;
-    isSystemUser = true;
-    description = "System User for Focalboard";
-    group = "focalboard";
-  };
-
   sops.secrets = {
     "focalboard/database" = {
       restartUnits = [ "podman-focalboard.service" "podman-focalboard-postgres.service" ];
@@ -63,7 +50,7 @@ in {
       domain = terakoda;
       dependsOn = [ "focalboard-postgres" ];
       port = 8000;
-      user = "${toString userIds.focalboard.uid}:${toString userIds.focalboard.gid}";
+      user = "${toString config.users.users.focalboard.uid}:${toString config.users.groups.focalboard.gid}";
       volumes = [
         "/tank/focalboard/data/files:/opt/focalboard/data/files"
         "${config.sops.templates."focalboard-config.json".path}:/opt/focalboard/config.json:ro"

system/hosts/mcp/containers/mariadb.nix

@@ -1,14 +1,6 @@
 # Common config for all mariadb containers
 { ... }:
-let
+{
-  userIds = import ./user-ids.nix;
-in {
-  users = {
-    groups."mariadb" = {
-      gid = userIds.mariadb.gid;
-    };
-  };
-
   sops.secrets."mariadb_root_password" = {
     restartUnits = [ "podman-mariadb.service" ];
     mode = "0440";

system/hosts/mcp/containers/offen.nix

@@ -1,10 +1,7 @@
 { config, ... }:
 let
   inherit (import ./lib.nix config) mkContainer terakoda;
-  userIds = import ./user-ids.nix;
 in {
-  users = userIds.mkUserAndGroup "offen" userIds.offen;
-
   sops = {
     secrets = {
       "offen/smtp-token" = {};
@@ -30,7 +27,7 @@ in {
     image = "offen/offen";
     hostName = "offen";
     domain = terakoda;
-    user = "${toString userIds.offen.uid}:${toString userIds.offen.gid}";
+    user = "${toString config.users.users.offen.uid}:${toString config.users.groups.offen.gid}";
     port = 80;
     volumes = [
       "${config.sops.templates."offen.env".path}:/etc/offen/offen.env:ro"

system/hosts/mcp/containers/pocket-id.nix

@@ -1,7 +1,6 @@
 { config, ... }:
 let 
   inherit (import ./lib.nix config) mkContainer blazestar;
-  userIds = import ./user-ids.nix;
   # The default is to run on port 80, which the pocket-id user cannot bind to.
   # We need a different port to be able to serve traffic.
   # The following ports in the container are already taken:
@@ -11,17 +10,6 @@ let
   port = 8888;
 in
 {
-  users.groups.pocket-id = {
-    gid = userIds.pocket-id.gid;
-  };
-
-  users.users.pocket-id = {
-    uid = userIds.pocket-id.uid;
-    isSystemUser = true;
-    description = "System User for Pocket ID";
-    group = "pocket-id";
-  };
-
   virtualisation.oci-containers.containers.pocket-id = mkContainer {
     image = "ghcr.io/pocket-id/pocket-id";
     dependsOn = [];
@@ -45,8 +33,8 @@ in
       CADDY_PORT = toString port;
       # PORT = "3000"; # Frontend port
       # BACKEND_PORT = "8080"; # Backend port
-      PUID = toString userIds.pocket-id.uid;
+      PUID = toString config.users.users."pocket-id".uid;
-      PGID = toString userIds.pocket-id.gid;
+      PGID = toString config.users.groups."pocket-id".gid;
     };
   };
 }