Run restic backups as non root users

modules/system/hedgedoc/backups.nix

@@ -4,11 +4,32 @@
   lib,
   ...
 }:
+let
+  user = config.users.users.hedgedoc.name;
+in
 {
   options.myConfig.hedgedoc.backups.enable = lib.mkEnableOption "";
 
   config = lib.mkIf config.myConfig.hedgedoc.backups.enable {
+    security.polkit = {
+      enable = true;
+      extraConfig =
+        let
+          service = "hedgedoc.service";
+        in
+        ''
+          polkit.addRule(function(action, subject) {
+            if (action.id == "org.freedesktop.systemd1.manage-units" &&
+              action.lookup("unit") == "${service}" &&
+              subject.user == "${user}") {
+              return polkit.Result.YES;
+            }
+          });
+        '';
+    };
+
     myConfig.resticBackup.hedgedoc = {
+      inherit user;
       healthchecks.enable = true;
 
       extraConfig = {
@@ -25,7 +46,7 @@
       (pkgs.writeShellApplication {
         name = "hedgedoc-restore";
         text = ''
-          sudo bash -c "
+          sudo --user=${user} bash -c "
             systemctl stop hedgedoc.service
             restic-hedgedoc restore latest --target /
             systemctl start hedgedoc.service