the service starts

data.nix

@@ -16,6 +16,8 @@ rec {
     jakstpub = 505;
 
     certget = 506;
+
+    photoprism = 507;
   };
 
   ports = {

hosts/vno1-oh2/configuration.nix

@@ -1,6 +1,6 @@
 {
   config,
-  lib,
+  #lib,
   pkgs,
   myData,
   ...
@@ -649,8 +649,12 @@
     };
 
     photoprism.serviceConfig = {
-      ProtectHome = lib.mkForce "tmpfs";
-      BindReadOnlyPaths = ["/home/motiejus/Pictures"];
+      #ProtectHome = lib.mkForce "tmpfs";
+      #BindPaths = ["/home/motiejus/Pictures"];
+      #DynamicUser = lib.mkForce false;
+      #LockPersonality = lib.mkForce false;
+      #PrivateDevices = lib.mkForce false;
+      #PrivateUsers = lib.mkForce false;
     };
   };
 
@@ -668,6 +672,16 @@
     };
   };
 
+  users = let
+    uidgid = myData.uidgid.photoprism;
+  in {
+    groups.photoprism.gid = uidgid;
+    users.photoprism = {
+      group = "photoprism";
+      uid = uidgid;
+    };
+  };
+
   environment.systemPackages = with pkgs; [
     imapsync
     geoipWithDatabase