nixos/misc/locate: Support running updatedb as user nobody

[devurandom]

Nixpkgs version

• Stable (26.05)

Describe the bug

Before NixOS 26.05 a service.locate.localuser option existed, with the intention to run updatedb as user nobody with restricted access, even though it was only applied when using findutils locate. Now the option is gone entirely -- updatedb is always run as root.

Steps to reproduce

Set services.locate.enable = true on NixOS 26.05.

Expected behaviour

I would like to have more fine-grained control over which user can find which files, and thus the option to run updatedb as a non-root user with restricted access.

Screenshots

No response

Relevant log output

Additional context

In Home Manager, I have set:

{
  systemd.user = {
    services = {
      updatedb = {
        Unit = {
          Description = "Update the per-user locate database";
          ConditionACPower = true;
        };
        Service = {
          Type = "oneshot";
          ExecStart = "${lib.getExe' osConfig.services.locate.package "updatedb"} --require-visibility no --output %h/.cache/locatedb --database-root %h";
          LimitNOFILE = 131072;
          IOSchedulingClass = "idle";
          PrivateTmp = true;
          PrivateDevices = true;
          PrivateNetwork = true;
        };
      };
    };
  };
}

Then I set LOCATE_PATH="${HOME}/.cache/locatedb" to merge the per-user locate DB and the system locate DB in searches. This way only my user can find their own files, but system files can be found by everyone.

System metadata

• system: "x86_64-linux"
• host os: Linux 7.2.0, NixOS, 26.05 (Yarara), 26.05.20260819.b18a4b9
• multi-user?: yes
• sandbox: yes
• version: nix-env (Nix) 2.34.8
• channels(root): "nixos"
• nixpkgs: /nix/store/9lplbspbhqv0lv5fzi7539kddrls0grp-source

Notify maintainers

@SuperSandro2000

---

Note for maintainers: Please tag this issue in your pull request description. (i.e. Resolves #ISSUE.)

I assert that this issue is relevant for Nixpkgs

• I assert that this is a bug and not a support request.
• I assert that this is not a duplicate of an existing issue.
• I assert that I have read the NixOS Code of Conduct and agree to abide by it.
• I assert that I have read the automation/AI policy and that this issue report complies with it.

Is this issue important to you?

Add a 👍 reaction to issues you find important.