Hi @domenkozar
I recently provisioned a new 15.09 release box which ad my own custom user on it with basic configuration and immutable users:

users = { 
    mutableUsers = false;
    extraGroup.me = {
        name = "me";
        gid = 1000;
    };
    extraUsers.me = {
        isNormalUser = true;
        uid = 1000;
        group = "me";
    };
};

This box's installation also included NetworkManager as part of Gnome3. An odd issue started to happen shortly, where when WiFI was to drop and reconnenct my user name would suddenly change to nm-openvpn, which I could tell when I would open a new terminal and the PS1 line showed "nm-openvpn@hostname"

Upon investigation of the /etc/password using getent it became clear that both users were created with the same uid. Here is the getent return

$ getent passwd me nm-openvpn

me:x:1000:1000::/home/me:/run/current-system/sw/bin/bash
nm-openvpn:x:1000:65534::/var/empty:/run/current-system/sw/bin/nologin

After looking over #10689 and kamilchm@832c4ee it seems that nm-openvpn is not created with a specific uid (nor it's counterpart group created with a specific gid). That said users.enforceIdUniqueness is set to true so I am a bit at a loss as how this happened and might indicate bug with mutable users. I'll try to reproduce the bug this week to see if that is the case.

Setting the potential user creation bug aside I would say that nm-openvpn user and group should have their own ids/gids in ids.nix. If that is the case I will be happy to do a PR, please advise on the following though: do you want 2 PRs, one against master and one against release-15.09. Also do you want me to reflect the change in release notes somewhere.

-- @goodwillcoding