nix/modules/knot: don't use an activation script to set up git user home

It's unidiomatic, and doesn't allow extension by way of changing the
systemd service options (like is done in the following commit).

Signed-off-by: Winter <[e-mail]>

nix/modules/knot.nix

···
         cfg.package
       ];
 
-      system.activationScripts.gitConfig = let
-        setMotd =
-          if cfg.motdFile != null && cfg.motd != null
-          then throw "motdFile and motd cannot be both set"
-          else ''
-            ${optionalString (cfg.motdFile != null) "cat ${cfg.motdFile} > ${cfg.stateDir}/motd"}
-            ${optionalString (cfg.motd != null) ''printf "${cfg.motd}" > ${cfg.stateDir}/motd''}
-          '';
-      in ''
-        mkdir -p "${cfg.repo.scanPath}"
-        chown -R ${cfg.gitUser}:${cfg.gitUser} "${cfg.repo.scanPath}"
-
-        mkdir -p "${cfg.stateDir}/.config/git"
-        cat > "${cfg.stateDir}/.config/git/config" << EOF
-        [user]
-            name = Git User
-            email = [e-mail]
-        [receive]
-            advertisePushOptions = true
-        EOF
-        ${setMotd}
-        chown -R ${cfg.gitUser}:${cfg.gitUser} "${cfg.stateDir}"
-      '';
-
       users.users.${cfg.gitUser} = {
         isSystemUser = true;
         useDefaultShell = true;
···
         description = "knot service";
         after = ["network.target" "sshd.service"];
         wantedBy = ["multi-user.target"];
+        enableStrictShellChecks = true;
+
+        preStart = let
+          setMotd =
+            if cfg.motdFile != null && cfg.motd != null
+            then throw "motdFile and motd cannot be both set"
+            else ''
+              ${optionalString (cfg.motdFile != null) "cat ${cfg.motdFile} > ${cfg.stateDir}/motd"}
+              ${optionalString (cfg.motd != null) ''printf "${cfg.motd}" > ${cfg.stateDir}/motd''}
+            '';
+        in ''
+          mkdir -p "${cfg.repo.scanPath}"
+          chown -R ${cfg.gitUser}:${cfg.gitUser} "${cfg.repo.scanPath}"
+
+          mkdir -p "${cfg.stateDir}/.config/git"
+          cat > "${cfg.stateDir}/.config/git/config" << EOF
+          [user]
+              name = Git User
+              email = [e-mail]
+          [receive]
+              advertisePushOptions = true
+          EOF
+          ${setMotd}
+          chown -R ${cfg.gitUser}:${cfg.gitUser} "${cfg.stateDir}"
+        '';
+
         serviceConfig = {
           User = cfg.gitUser;
+          PermissionsStartOnly = true;
           WorkingDirectory = cfg.stateDir;
           Environment = [
             "KNOT_REPO_SCAN_PATH=${cfg.repo.scanPath}"