pinchflat: use a static user (#415304)

nixos/modules/services/misc/pinchflat.nix

@@ -62,6 +62,22 @@ in
         description = "Log level for Pinchflat.";
       };
 
+      user = lib.mkOption {
+        type = lib.types.str;
+        default = "pinchflat";
+        description = ''
+          User account under which Pinchflat runs.
+        '';
+      };
+
+      group = lib.mkOption {
+        type = lib.types.str;
+        default = "pinchflat";
+        description = ''
+          Group under which Pinchflat runs.
+        '';
+      };
+
       extraConfig = mkOption {
         type =
           with types;
@@ -125,7 +141,9 @@ in
 
       serviceConfig = {
         Type = "simple";
-        DynamicUser = true;
+        User = cfg.user;
+        Group = cfg.group;
+
         StateDirectory = baseNameOf stateDir;
         Environment =
           [
@@ -151,6 +169,17 @@ in
       };
     };
 
+    users.users = lib.mkIf (cfg.user == "pinchflat") {
+      pinchflat = {
+        group = cfg.group;
+        isSystemUser = true;
+      };
+    };
+
+    users.groups = lib.mkIf (cfg.group == "pinchflat") {
+      pinchflat = { };
+    };
+
     networking.firewall = mkIf cfg.openFirewall {
       allowedTCPPorts = [ cfg.port ];
     };