rabbitmq: fix unit file generation

[dpausp]

Fixes changes made in #1242

optionalString generates an empty string if the condition is not met. This resulted in an overides.conf for rabbitmq.service which just contains some auto-generated env vars in [service].

For the "frozen" rabbitmq 3.6 service/role, the new PATH replaced the PATH set by the original unit, leading to a "command not found" for rabbitmqctl in postStart.

Setting feature flags isn't possible for rabbitmq 3.6, the rabbitmqctl command must only run for current rabbitmq versions.

For other machines without rabbitmq, this also generated an empty unit file because there was no condition to check if rabbitmq is actually enabled on this machine.

We need to limit this to the current Rabbitmq role and use mkIf here to prevent setting the option at all when conditions are not met.

PL-133374

@flyingcircusio/release-managers

Release process

• Created changelog entry using ./changelog.sh
  • not necessary

PR release workflow (internal)

• PR has internal ticket
• internal issue ID (PL-…) part of branch name
• internal issue ID mentioned in PR description text
• ticket is on Platform agile board
• ticket state set to Pull request ready
• if ticket is more urgent than within the next few days, directly contact a member of the Platform team

Design notes

• Provide a feature toggle if the change might need to be adjusted/reverted quickly depending on context. Consider whether the default should be on or off. Example: rate limiting.
• All customer-facing features and (NixOS) options need to be discoverable from documentation. Add or update relevant documentation such that hosted and guided customers can understand it as well.

Security implications

• Security requirements defined? (WHERE)
  • follow-up to rabbitmq: auto-enable feature flags after upgrade #1242
  • feature flag settings code must not be active for rabbitmq 3.6
  • other machines without the rabbitmq role must not be affected by rabbitmq role code
• Security requirements tested? (EVIDENCE)
  • checked on a test VM with the rabbitmq role that rabbitmq starts and no overrides.conf is present
  • checked on a test VM without any rabbitmq roles that no rabbitmq.service is present