From dcfee1fb3251268fcbf7198e92bdd33f08fb4a8d Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 11 Aug 2026 02:44:12 +0000
Subject: [PATCH] fix: address btcpay hardening review feedback

Co-authored-by: naturallaw777 <99053422+naturallaw777@users.noreply.github.com>
---
 modules/bitcoin/bitcoind.nix     | 8 ++++----
 modules/bitcoin/btcpayserver.nix | 5 ++---
 2 files changed, 6 insertions(+), 7 deletions(-)

diff --git a/modules/bitcoin/bitcoind.nix b/modules/bitcoin/bitcoind.nix
index e33e37b..4a3ff3b 100644
--- a/modules/bitcoin/bitcoind.nix
+++ b/modules/bitcoin/bitcoind.nix
@@ -423,21 +423,21 @@ in {
 
           if [[ ! -e "$hmacFile" ]]; then
             echo "Error: Bitcoin RPC HMAC file is missing: $hmacFile" >&2
-            exit 1
+            return 1
           fi
           if [[ ! -r "$hmacFile" ]]; then
             echo "Error: Bitcoin RPC HMAC file is unreadable: $hmacFile" >&2
-            exit 1
+            return 1
           fi
 
           hmacPayload="$(<"$hmacFile")"
           if [[ -z "$hmacPayload" ]]; then
             echo "Error: Bitcoin RPC HMAC file is empty: $hmacFile" >&2
-            exit 1
+            return 1
           fi
           if [[ ! "$hmacPayload" =~ ^[[:xdigit:]]+\$[[:xdigit:]]+$ ]]; then
             echo "Error: Bitcoin RPC HMAC file has invalid format: $hmacFile" >&2
-            exit 1
+            return 1
           fi
 
           printf '%s\n' "$hmacPayload"
diff --git a/modules/bitcoin/btcpayserver.nix b/modules/bitcoin/btcpayserver.nix
index 9dbcafb..a07a667 100644
--- a/modules/bitcoin/btcpayserver.nix
+++ b/modules/bitcoin/btcpayserver.nix
@@ -264,9 +264,8 @@ in {
         );
       in rec {
         wantedBy = [ "multi-user.target" ];
-        requires = [ "postgresql.target" ];
-        wants = [ "nbxplorer.service" ]
-          ++ optional (cfg.btcpayserver.lightningBackend == "lnd") "lnd.service";
+        requires = [ "postgresql.target" "nbxplorer.service" ];
+        wants = optional (cfg.btcpayserver.lightningBackend == "lnd") "lnd.service";
         after = requires ++ wants;
         serviceConfig = nbLib.defaultHardening // {
           ExecStart = ''