use dedicated podman user for rootless containers

Adds a system user 'podman' (uid 900) with subuid/subgid ranges
and linger for running OCI containers. Removes podman-specific
settings from lew user. DokuWiki switches to sdnotify=healthy
since the image has a built-in healthcheck.

hosts/lab/default.nix

@@ -23,6 +23,18 @@
 
   security.sudo.wheelNeedsPassword = false;
 
+  users.users.podman = {
+    isSystemUser = true;
+    group = "podman";
+    home = "/var/lib/podman";
+    createHome = true;
+    uid = 900;
+    linger = true;
+    subUidRanges = [{ startUid = 100000; count = 65536; }];
+    subGidRanges = [{ startGid = 100000; count = 65536; }];
+  };
+  users.groups.podman = {};
+
   virtualisation.containers.enable = true;
   virtualisation.podman = {
     enable = true;

hosts/lab/dokuwiki.nix

@@ -9,7 +9,8 @@
 
   virtualisation.oci-containers.containers.dokuwiki = {
     image = "lscr.io/linuxserver/dokuwiki:2025-05-14b-ls299";
-    podman.user = "lew";
+    podman.user = "podman";
+    podman.sdnotify = "healthy";
     environment = {
       PUID = "1000";
       PGID = "1000";
@@ -21,7 +22,4 @@
     ];
     ports = [ "127.0.0.1:8070:80" ];
   };
-
-  # Workaround for NixOS/nixpkgs#410857 until backport of #475089 lands
-  systemd.services.podman-dokuwiki.serviceConfig.Delegate = true;
 }

hosts/lab/foundry.nix

@@ -11,8 +11,7 @@
     image = "node:22.22.2-slim";
     cmd = [ "node" "main.js" "--dataPath=/data" ];
     workdir = "/app";
-    user = "1000:1000";
-    podman.user = "lew";
+    podman.user = "podman";
     volumes = [
       "/srv/foundry/app:/app:ro"
       "/srv/foundry/data:/data"