1 files changed, 21 insertions, 1 deletions
diff --git a/application/module.nix b/application/module.nix
index 78ac546..3689996 100644
--- a/application/module.nix
+++ b/application/module.nix
@@ -28,6 +28,18 @@ in
       default = self.packages.${system}.default;
     };
 
+    user = mkOption {
+      type = types.nonEmptyStr;
+      default = "specimen";
+      description = "user under which specimen will run.";
+    };
+
+    group = mkOption {
+      type = types.nonEmptyStr;
+      default = "specimen";
+      description = "group under which specimen will run.";
+    };
+
     port = mkOption {
       type = types.port;
       default = 4444;
@@ -55,6 +67,13 @@ in
   config = mkIf cfg.enable {
     networking.firewall.allowedTCPPorts = mkIf cfg.openFirewall [ cfg.port ];
 
+    users.users.${cfg.user} = {
+      description = "specimen user";
+      group = cfg.group;
+      isSystemUser = true;
+    };
+    users.groups.${cfg.group} = { };
+
     systemd.services.specimen = {
       description = "specimen application service";
       wantedBy = [ "multi-user.target" ];
@@ -62,7 +81,8 @@ in
       after = [ "network.target" ];
 
       serviceConfig = {
-        DynamicUser = true;
+        User = cfg.user;
+        Group = cfg.user;
         Type = "exec";
         Restart = "always";
         ExecStart = "${cfg.package}/bin/specimen -address ${cfg.listenAddress} -port ${toString cfg.port} -name ${cfg.namePath}";