refactor(dyndns): move dyndns config into own module

nixos/server/default.nix

@@ -2,21 +2,17 @@
   inputs,
   outputs,
   config,
-  pkgs,
   ...
 }:
-let
-  dyndnsScript = pkgs.writeScript "dyndns.py" (builtins.readFile ./dyndns.py);
-in
 {
   imports = [
     (import ../base.nix { inherit inputs outputs; })
     ./hardware-configuration.nix
-    ./secrets
     inputs.agenix.nixosModules.default
+    ./secrets
+    ./dyndns.nix
   ];
 
-  users.groups.dyndns = { };
   users.users = {
     leonhard = {
       initialPassword = "leonhard";
@@ -24,31 +20,6 @@ in
       extraGroups = [ "wheel" ];
       openssh.authorizedKeys.keys = config.kekleo.publicKeys;
     };
-    dyndns = {
-      isSystemUser = true;
-      group = "dyndns";
-      packages = [ pkgs.python313Packages.nc-dnsapi ];
-    };
-  };
-
-  systemd.timers."dyndns" = {
-    wantedBy = [ "timers.target" ];
-    timerConfig = {
-      OnBootSec = "5m";
-      OnUnitActiveSec = "5m";
-      Unit = "dyndns.service";
-    };
-  };
-
-  systemd.services."dyndns" = {
-    script = ''
-      set -eu
-      ${pkgs.python313}/bin/python3 ${dyndnsScript}
-    '';
-    serviceConfig = {
-      Type = "oneshot";
-      User = "dyndns";
-    };
   };
 
   networking = {

nixos/server/dyndns.nix

@@ -0,0 +1,33 @@
+{
+  pkgs,
+  ...
+}:
+{
+  users.groups.dyndns = { };
+  users.users.dyndns = {
+    isSystemUser = true;
+    group = "dyndns";
+    createHome = true;
+    home = /var/dyndns;
+    packages = [ pkgs.python313Packages.nc-dnsapi ];
+  };
+
+  systemd.timers."dyndns" = {
+    wantedBy = [ "timers.target" ];
+    timerConfig = {
+      OnBootSec = "5m";
+      OnUnitActiveSec = "5m";
+      Unit = "dyndns.service";
+    };
+  };
+
+  systemd.services."dyndns" = {
+    script = ''
+      python3 -c "${builtins.readFile ./dyndns.py}"
+    '';
+    serviceConfig = {
+      Type = "oneshot";
+      User = "dyndns";
+    };
+  };
+}