nixos/github-runner: fix bugs related to `InaccessiblePaths=`

This commit fixes two bugs:

1) When starting a github-runner for the very first time, the
   unconfigure script did not copy the `tokenFile` to the state
   directory. This case just was not handled so far. As a result, the
   runner could not configure. The unit did, however, fail even before
   as the state token file is configured as inaccessible for the service
   through `InaccessiblePaths=`. As the given path did not exist in the
   described case, setting up the unit's namespacing failed.

2) Similarly, the `tokenFile` is also marked as not accessible to the
   service user. There are, however, cases where other namespacing
   options make the files inaccessible even before `InaccessiblePaths=`
   kicks in; thus, they appear as non existing and cause the namespacing
   to fail yet again. Prefixing the entry with a `-` causes Systemd to
   ignore the entry if it cannot find it. This is the behavior we want.

I also took fixing those bugs as a chance to refactor the unconfigure
script to make it easier to follow.

0 files changed, 0 insertions, 0 deletions