nixos/ceph: run unprivileged, use state directories, handle non-initialized clusters without config switch