nixpkgs removed services.nextcloud.config.{adminuser,adminpassFile} and now installs with --disable-admin-user. Add a nextcloud-admin-user oneshot that creates the admin account from the vars secret after nextcloud-setup.