nixos/znc: harden systemd unit

[dotlambda]

Motivation for this change

Things done

• Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS linux)
• Built on platform(s)
  • NixOS
  • macOS
  • other Linux distributions
• Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
• Tested compilation of all pkgs that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review wip"
• Tested execution of all binary files (usually in ./result/bin/)
• Determined the impact on package closure size (by running nix path-info -S before and after)
• Ensured that relevant documentation is up to date
• Fits CONTRIBUTING.md.

[dotlambda]

I think znc creates files with umask 0077 by default, so maybe we should set the same? I don't understand why people do that: It's useful to have a way to give a process (e.g. a backup program) just read access by using the group.

[eyJhb]

Quite sure this breaks using chown on ie. https://github.com/NixOS/nixpkgs/blob/nixos-unstable/nixos/modules/services/networking/znc/default.nix#L276

Currently getting

May 21 11:23:54 tutti znc-pre-start[1674]: znc is set to be system-managed. Now deleting old znc.conf file to be regenerated.
May 21 11:23:54 tutti znc-pre-start[1674]: No znc.conf file found in /var/lib/znc. Creating one now.
May 21 11:23:54 tutti systemd-coredump[1682]: Process 1680 (chown) of user 128 dumped core.
May 21 11:23:54 tutti znc-pre-start[1674]: /nix/store/l9aigmli01ydzd8cf93mls41hmh2bgkj-unit-script-znc-pre-start/bin/znc-pre-start: line 15:  1680 Bad system call         (core dumped) chown znc /var/lib/znc/configs/znc.conf

[winterqt]

I haven't gotten to the entire "why" of the issue yet (see below), but this needs to include AF_UNIX in order for ZNC to make host lookups, because of nscd.

Is anyone running this in a default configuration who doesn't have DNS lookup issues? I'm not sure why I'd be running into issues and nobody else is, I don't have an abnormal nsswitch configuration or anything...