Only launch ejabberd if env is available

lib/fudo/jabber.nix

@@ -6,7 +6,8 @@ let
 
   host-secrets = config.fudo.secrets.host-secrets.${hostname};
 
-  siteOpts = { ... }: with types; {
+  siteOpts = { ... }:
+    with types; {
       options = {
         enableACME = mkOption {
           type = bool;
@@ -28,24 +29,22 @@ let
 
   config-dir = dirOf cfg.config-file;
 
-  concatMapAttrs = f: attrs:
+  concatMapAttrs = f: attrs: foldr (a: b: a // b) { } (mapAttrs f attrs);
-    foldr (a: b: a // b) {} (mapAttrs f attrs);
 
   concatMapAttrsToList = f: attr:
     concatMap (i: i) (attrValues (mapAttrs f attr));
 
   host-domains = config.fudo.acme.host-domains.${hostname};
 
-  hostCerts = host: let
+  hostCerts = host:
-    cert-copy = host-domains.${host}.local-copies.ejabberd;
+    let cert-copy = host-domains.${host}.local-copies.ejabberd;
     in [
       cert-copy.certificate
       cert-copy.private-key
       # cert-copy.full-certificate
     ];
 
-  hostCertService = host:
+  hostCertService = host: host-domains.${host}.local-copies.ejabberd.service;
-    host-domains.${host}.local-copies.ejabberd.service;
 
   config-file-template = let
     jabber-config = {
@@ -60,8 +59,7 @@ let
 
       acl.admin = {
         user = concatMap
-          (admin: map (site: "${admin}@${site}")
+          (admin: map (site: "${admin}@${site}") (attrNames cfg.sites))
-            (attrNames cfg.sites))
           cfg.admins;
       };
 
@@ -77,35 +75,28 @@ let
           starttls = true;
           starttls_required = true;
         };
-      in
+      in if (cfg.listen-ips != null) then
-        if (cfg.listen-ips != null) then
+        map (ip: { ip = ip; } // common) cfg.listen-ips
-          map (ip: { ip = ip; } // common)
+      else
-            cfg.listen-ips
+        [ common ];
-        else [ common ];
 
-      certfiles = concatMapAttrsToList
+      certfiles = concatMapAttrsToList (site: siteOpts:
-        (site: siteOpts:
+        if (siteOpts.enableACME) then (hostCerts siteOpts.hostname) else [ ])
-          if (siteOpts.enableACME) then
-            (hostCerts siteOpts.hostname)
-          else [])
         cfg.sites;
 
-      host_config =
+      host_config = mapAttrs (site: siteOpts: siteOpts.site-config) cfg.sites;
-        mapAttrs (site: siteOpts: siteOpts.site-config)
-          cfg.sites;
     };
 
     config-file = builtins.toJSON jabber-config;
   in pkgs.lib.text.format-json-file
   (pkgs.writeText "ejabberd.config.yml.template" config-file);
 
-  enter-secrets = template: secrets: target: let
+  enter-secrets = template: secrets: target:
-    secret-swappers = map
+    let
-      (secret: "sed s/${secret}/\$${secret}/g")
+      secret-swappers = map (secret: "sed s/${secret}/\$${secret}/g") secrets;
-      secrets;
       swapper = concatStringsSep " | " secret-swappers;
     in pkgs.writeShellScript "ejabberd-generate-config.sh" ''
-    [ -f \$${target} ] && rm -f ${target}
+      [ -f \$''${target} ] && rm -f ${target}
       echo "Copying from ${template} to ${target}"
       touch ${target}
       chmod go-rwx ${target}
@@ -160,7 +151,8 @@ in {
 
     secret-files = mkOption {
       type = attrsOf str;
-      description = "Map of secret-name to file. File contents will be subbed for the name in the config.";
+      description =
+        "Map of secret-name to file. File contents will be subbed for the name in the config.";
       default = { };
     };
 
@@ -195,21 +187,14 @@ in {
 
   config = mkIf cfg.enable {
     users = {
-      users.${cfg.user} = {
+      users.${cfg.user} = { isSystemUser = true; };
-        isSystemUser = true;
+
+      groups.${cfg.group} = { members = [ cfg.user ]; };
     };
 
-      groups.${cfg.group} = {
+    networking.firewall = { allowedTCPPorts = [ 5222 5223 5269 8010 ]; };
-        members = [ cfg.user ];
-      };
-    };
 
-    networking.firewall = {
+    fudo = let host-fqdn = config.instance.host-fqdn;
-      allowedTCPPorts = [ 5222 5223 5269 8010 ];
-    };
-
-    fudo = let
-      host-fqdn = config.instance.host-fqdn;
     in {
       acme.host-domains.${hostname} = mapAttrs' (site: siteOpts:
         nameValuePair siteOpts.hostname {
@@ -238,8 +223,7 @@ in {
 
       services = {
         ejabberd = {
-          wants =
+          wants = map hostCertService
-            map hostCertService
             (mapAttrsToList (_: siteOpts: siteOpts.hostname) cfg.sites);
           requires = [ "ejabberd-config-generator.service" ];
           environment = cfg.environment;
@@ -247,19 +231,24 @@ in {
 
         ejabberd-config-generator = let
           config-generator =
-            enter-secrets config-file-template (attrNames cfg.secret-files) cfg.config-file;
+            enter-secrets config-file-template (attrNames cfg.secret-files)
+            cfg.config-file;
         in {
           description = "Generate ejabberd config file containing passwords.";
           serviceConfig = {
             User = cfg.user;
             ExecStart = "${config-generator}";
-            ExecStartPost = pkgs.writeShellScript "protect-ejabberd-config.sh" ''
+            ExecStartPost =
+              pkgs.writeShellScript "protect-ejabberd-config.sh" ''
                 chown ${cfg.user}:${cfg.group} ${cfg.config-file}
                 chmod 0400 ${cfg.config-file}
               '';
             EnvironmentFile = host-secrets.ejabberd-password-env.target-file;
           };
+          unitConfig.ConditionPathExists =
+            [ host-secrets.ejabberd-password-env.target-file ];
           requires = [ host-secrets.ejabberd-password-env.service ];
+          after = [ host-secrets.ejabberd-password-env.service ];
         };
       };
     };