Support running service as real user to access home directories

- NixOS module conditionally applies restrictions based on user
- When user != 'backlog', disables ProtectHome and ProtectSystem
- Allows service to access ~/... paths when running as real user
- Update placeholder to show absolute path example

nix/module.nix

@@ -8,6 +8,7 @@
 let
   cfg = config.services.personal-backlog;
   package = pkgs.callPackage ./package.nix { };
+  isDefaultUser = cfg.user == "backlog";
 in
 {
   options.services.personal-backlog = {
@@ -35,7 +36,7 @@ in
     user = lib.mkOption {
       type = lib.types.str;
       default = "backlog";
-      description = "User account under which the service runs.";
+      description = "User account under which the service runs. Set to your username to access home directories.";
     };
 
     group = lib.mkOption {
@@ -52,14 +53,14 @@ in
   };
 
   config = lib.mkIf cfg.enable {
-    users.users.${cfg.user} = {
+    users.users.${cfg.user} = lib.mkIf isDefaultUser {
       isSystemUser = true;
       group = cfg.group;
       home = cfg.dataDir;
       createHome = true;
     };
 
-    users.groups.${cfg.group} = { };
+    users.groups.${cfg.group} = lib.mkIf isDefaultUser { };
 
     systemd.services.personal-backlog = {
       description = "Personal Backlog Task Manager";
@@ -75,14 +76,14 @@ in
         Restart = "on-failure";
         RestartSec = 5;
 
-        StateDirectory = "personal-backlog";
+        StateDirectory = lib.mkIf isDefaultUser "personal-backlog";
-        StateDirectoryMode = "0750";
+        StateDirectoryMode = lib.mkIf isDefaultUser "0750";
 
         NoNewPrivileges = true;
-        ProtectSystem = "strict";
+        ProtectSystem = lib.mkIf isDefaultUser "strict";
-        ProtectHome = true;
+        ProtectHome = lib.mkIf isDefaultUser true;
         PrivateTmp = true;
-        ReadWritePaths = [ cfg.dataDir ];
+        ReadWritePaths = lib.mkIf isDefaultUser [ cfg.dataDir ];
       };
     };