staging: run node_exporter from nixos; run synapse as non-root

cluster/staging/app/im/deploy/im-nix.hcl

@@ -46,7 +46,6 @@ job "im" {
           "secrets/litestream.yml" = "/etc/litestream.yml"
         }
       }
-      user = "root"
 
       template {
         data = file("../config/litestream.yml")
@@ -82,7 +81,6 @@ job "im" {
       env = {
         SSL_CERT_FILE = "/etc/ssl/certs/ca-bundle.crt"
       }
-      user = "root"
 
       template {
         data = file("flake.nix")
@@ -148,7 +146,6 @@ job "im" {
           "../alloc/data" = "/ephemeral",
         }
       }
-      user = "root"
 
       template {
         data = file("flake.nix")
@@ -195,7 +192,6 @@ EOH
           "secrets/litestream.yml" = "/etc/litestream.yml"
         }
       }
-      user = "root"
 
       template {
         data = file("../config/litestream.yml")

cluster/staging/app/telemetry/deploy/telemetry-system.hcl

@@ -9,15 +9,15 @@ job "telemetry-system" {
     }
 
     task "node_exporter" {
-			driver = "docker"
+      driver = "nix2"
 
       config {
-				image = "quay.io/prometheus/node-exporter:v1.1.2"
+        packages = [ "#prometheus-node-exporter" ]
-				network_mode = "host"
+        command = "node_exporter"
-				volumes = [
-					"/:/host:ro,rslave"
-				]
         args = [ "--path.rootfs=/host" ]
+        bind_read_only = {
+          "/" = "/host"
+        }
       }
 
       resources {
@@ -26,15 +26,12 @@ job "telemetry-system" {
       }
 
       service {
-        tags = [ "telemetry" ]
-        port = 9100
-        address_mode = "driver"
         name = "node-exporter"
+        tags = [ "telemetry" ]
+        port = "node_exporter"
         check {
           type = "http"
           path = "/"
-          port = 9100
-          address_mode = "driver"
           interval = "60s"
           timeout = "5s"
           check_restart {