
If the database is local, use postgres peer authentication. Otherwise, use a password file. Leave database initialisation to postgresql.ensure*. Leave /var/lib/roundcube creation to systemd. Run php upgrade script as unpriviledged user.
*** NixOS *** NixOS is a Linux distribution based on the purely functional package management system Nix. More information can be found at http://nixos.org/nixos and in the manual in doc/manual.