configuration: set extraGroups
gitignore: passwords.nix