This reuses the `pkgs`, so that `pkgs.nixosTests.nix-serve` will run with the overlays of `pkgs` applied.
nogroup is insecure if shared