nixos/ntfy-sh: add defaults, use dynamic user

nixos/modules/services/misc/ntfy-sh.nix

···
       description = mdDoc "The ntfy.sh package to use.";
     };
 
-    user = mkOption {
-      default = "ntfy-sh";
-      type = types.str;
-      description = lib.mdDoc "User the ntfy-sh server runs under.";
-    };
-
-    group = mkOption {
-      default = "ntfy-sh";
-      type = types.str;
-      description = lib.mdDoc "Primary group of ntfy-sh user.";
-    };
-
     settings = mkOption {
       type = types.submodule { freeformType = settingsFormat.type; };
 
···
 
       services.ntfy-sh.settings = {
         auth-file = mkDefault "/var/lib/ntfy-sh/user.db";
+        listen-http = mkDefault "127.0.0.1:2586";
+        attachment-cache-dir = mkDefault "/var/lib/ntfy-sh/attachments";
+        cache-file = mkDefault "/var/lib/ntfy-sh/cache-file.db";
       };
 
       systemd.services.ntfy-sh = {
···
         after = [ "network.target" ];
 
         serviceConfig = {
+          ExecStartPre = [
+            "${pkgs.coreutils}/bin/touch ${cfg.settings.auth-file}"
+            "${pkgs.coreutils}/bin/mkdir -p ${cfg.settings.attachment-cache-dir}"
+            "${pkgs.coreutils}/bin/touch ${cfg.settings.cache-file}"
+          ];
           ExecStart = "${cfg.package}/bin/ntfy serve -c ${configuration}";
-          User = cfg.user;
           StateDirectory = "ntfy-sh";
 
+          DynamicUser = true;
           AmbientCapabilities = "CAP_NET_BIND_SERVICE";
           PrivateTmp = true;
           NoNewPrivileges = true;
···
           RestrictNamespaces = true;
           RestrictRealtime = true;
           MemoryDenyWriteExecute = true;
-        };
-      };
-
-      users.groups = optionalAttrs (cfg.group == "ntfy-sh") {
-        ntfy-sh = { };
-      };
-
-      users.users = optionalAttrs (cfg.user == "ntfy-sh") {
-        ntfy-sh = {
-          isSystemUser = true;
-          group = cfg.group;
+          # Upstream Requirements
+          LimitNOFILE = 20500;
         };
       };
     };

nixos/tests/ntfy-sh.nix

···
     notif = json.loads(machine.succeed("curl -s localhost:80/test/json?poll=1"))
 
     assert msg == notif["message"], "Wrong message"
+
+    machine.succeed("ntfy user list")
   '';
 }