refactor(oksys): move user groups to their relevant module

devices/oksys/default.nix

@@ -17,8 +17,6 @@
       "wheel"
       "adm"
       "mlocate"
-      "headscale"
-      "unbound"
     ];
   };
   home-manager.users = {

devices/oksys/modules/headscale.nix

@@ -1,15 +1,18 @@
 {
   headscale,
   pkgs,
+  config,
   ...
-}: {
-  environment.systemPackages = [
-    headscale.packages.${pkgs.system}.headscale
-  ];
+}: let
+  headscale-flake = headscale.packages.${pkgs.system}.headscale;
+  user = config.services.device-vars.username;
+in {
+  environment.systemPackages = [headscale-flake];
+  users.users.${user}.extraGroups = ["headscale"];
 
   services.headscale = {
     enable = true;
-    package = headscale.packages.${pkgs.system}.headscale;
+    package = headscale-flake;
 
     address = "127.0.0.1";
     port = 8085;

devices/oksys/modules/unbound.nix

@@ -1,7 +1,11 @@
-{...}: {
+{config, ...}: let
+  user = config.services.device-vars.username;
+in {
   # https://github.com/MatthewVance/unbound-docker-rpi/issues/4#issuecomment-1001879602
   boot.kernel.sysctl."net.core.rmem_max" = 1048576;
 
+  users.users.${user}.extraGroups = ["unbound"];
+
   services.unbound = {
     enable = true;
     enableRootTrustAnchor = true;