From 9f316d886cdfb82abdb8eefb8e40773c8a4ca033 Mon Sep 17 00:00:00 2001
From: Morgan Jones <me@numin.it>
Date: Tue, 11 Nov 2025 21:29:31 -0800
Subject: [PATCH] nixos/nebula-lighthouse-service: run as lower privilege user

---
 .../networking/nebula-lighthouse-service.nix   | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/nixos/modules/services/networking/nebula-lighthouse-service.nix b/nixos/modules/services/networking/nebula-lighthouse-service.nix
index 0c747129d447..cd9371cba2ae 100644
--- a/nixos/modules/services/networking/nebula-lighthouse-service.nix
+++ b/nixos/modules/services/networking/nebula-lighthouse-service.nix
@@ -6,6 +6,8 @@
 }:
 
 let
+  inherit (lib) types;
+
   cfg = config.services.nebula-lighthouse-service;
   settingsFormat = pkgs.formats.yaml { };
 in
@@ -13,6 +15,14 @@ in
 
   options.services.nebula-lighthouse-service = {
     enable = lib.mkEnableOption "nebula-lighthouse-service";
+    user = lib.mkOption {
+      type = types.str;
+      default = "nebula-lighthouse";
+      description = ''
+        The user and group to run nebula-lighthouse-service as.
+      '';
+      example = "nebula-lighthouse";
+    };
     settings = lib.mkOption {
       type = settingsFormat.type;
       default = { };
@@ -50,8 +60,16 @@ in
         Restart = "always";
         ExecStart = "${pkgs.nebula-lighthouse-service}/bin/nebula-lighthouse-service";
         StateDirectory = "nebula-lighthouse-service";
+        User = cfg.user;
+        Group = cfg.user;
       };
     };
+    users.users.${cfg.user} = {
+      group = cfg.user;
+      description = "nebula-lighthouse-service user";
+      isSystemUser = true;
+    };
+    users.groups.${cfg.user} = { };
   };
   meta.maintainers = with lib.maintainers; [
     bloominstrong