Mark grafana's and home-assistant's soft requirements optional (hq issue 166, ADR 0330)

grafana runs without influxdb and home-assistant without the Servarr apps or a broker, yet a mesh
without them could not assign either. Their requirements are now optional: bound when a provider
runs, absent otherwise, with nothing installed for them. grafana's data source and its credential are
delivered only while influxdb-api is bound, into directories it mounts, so an absent file never
becomes a directory docker made in its place.

modules/grafana/module.json

@@ -71,20 +71,36 @@
       "mode": "0644",
       "content": "GF_SERVER_ROOT_URL=https://${bound:route:name}\nGF_AUTH_GENERIC_OAUTH_ENABLED=true\nGF_AUTH_GENERIC_OAUTH_NAME=Keycloak\nGF_AUTH_GENERIC_OAUTH_CLIENT_ID=${bound:oidc-client:as}\nGF_AUTH_GENERIC_OAUTH_CLIENT_SECRET__FILE=/run/secrets/oidc-client\nGF_AUTH_GENERIC_OAUTH_SCOPES=openid email profile roles\nGF_AUTH_GENERIC_OAUTH_AUTH_URL=${bound:oidc-client:issuer}${bound:oidc-client:authorization-path}\nGF_AUTH_GENERIC_OAUTH_TOKEN_URL=${bound:oidc-client:issuer}${bound:oidc-client:token-path}\nGF_AUTH_GENERIC_OAUTH_API_URL=${bound:oidc-client:issuer}${bound:oidc-client:userinfo-path}\nGF_AUTH_GENERIC_OAUTH_ROLE_ATTRIBUTE_PATH=contains(roles[*], 'admin') && 'Admin' || contains(realm_access.roles[*], 'admin') && 'Admin' || 'Viewer'\nGF_AUTH_GENERIC_OAUTH_USE_PKCE=true\nGF_AUTH_GENERIC_OAUTH_ALLOW_SIGN_UP=true\nGF_AUTH_GENERIC_OAUTH_ALLOW_ASSIGN_GRAFANA_ADMIN=true\n"
     },
+    {
+      "id": "influxdb-datasources",
+      "type": "directory",
+      "path": "${dir:state}/datasources",
+      "mode": "0755",
+      "owner": "472:472"
+    },
+    {
+      "id": "influxdb-credential",
+      "type": "directory",
+      "path": "${dir:state}/influxdb",
+      "mode": "0700",
+      "owner": "472:472"
+    },
     {
       "id": "influxdb-secret",
       "type": "file",
-      "path": "${dir:state}/influxdb-api.secret",
+      "path": "${dir:influxdb-credential}/influxdb-api",
       "mode": "0400",
       "owner": "472:472",
-      "content": "${secret:influxdb-api}"
+      "content": "${secret:influxdb-api}",
+      "only-when-bound": "influxdb-api"
     },
     {
       "id": "influxdb-datasource",
       "type": "file",
-      "path": "${dir:state}/datasource-influxdb.yaml",
+      "path": "${dir:influxdb-datasources}/mesh-influxdb.yaml",
       "mode": "0644",
-      "content": "apiVersion: 1\n# Written by the mesh from grafana's influxdb-api binding; grafana reads it at start. Its own name and\n# uid, so a data source somebody made in the UI is never overwritten, and read-only in the UI because\n# the mesh resets it. The password is read from the file the mesh delivers, never written here.\ndatasources:\n  - name: InfluxDB (mesh)\n    uid: mesh-influxdb-api\n    type: influxdb\n    access: proxy\n    url: ${bound:influxdb-api:scheme}://${bound:influxdb-api:at}:${bound:influxdb-api:port}\n    user: ${bound:influxdb-api:as}\n    isDefault: false\n    editable: false\n    jsonData:\n      dbName: ${bound:influxdb-api:bucket}\n      httpMode: POST\n    secureJsonData:\n      password: $__file{/run/secrets/influxdb-api}\n"
+      "content": "apiVersion: 1\n# Written by the mesh from grafana's influxdb-api binding, only while it is bound (novox/hq ADR 0330):\n# without influxdb, grafana runs with no mesh data source. grafana reads it at start. Its own name and\n# uid, so a data source somebody made in the UI is never overwritten, and read-only in the UI because\n# the mesh resets it. The password is read from the file the mesh delivers, never written here.\ndatasources:\n  - name: InfluxDB (mesh)\n    uid: mesh-influxdb-api\n    type: influxdb\n    access: proxy\n    url: ${bound:influxdb-api:scheme}://${bound:influxdb-api:at}:${bound:influxdb-api:port}\n    user: ${bound:influxdb-api:as}\n    isDefault: false\n    editable: false\n    jsonData:\n      dbName: ${bound:influxdb-api:bucket}\n      httpMode: POST\n    secureJsonData:\n      password: $__file{/run/secrets/influxdb/influxdb-api}\n",
+      "only-when-bound": "influxdb-api"
     },
     {
       "id": "server",
@@ -103,8 +119,8 @@
         "${dir:data}:/var/lib/grafana",
         "${dir:state}/admin.secret:/run/secrets/admin:ro",
         "${dir:state}/oidc-client.secret:/run/secrets/oidc-client:ro",
-        "${dir:state}/influxdb-api.secret:/run/secrets/influxdb-api:ro",
-        "${dir:state}/datasource-influxdb.yaml:/etc/grafana/provisioning/datasources/mesh-influxdb.yaml:ro"
+        "${dir:influxdb-credential}:/run/secrets/influxdb:ro",
+        "${dir:influxdb-datasources}:/etc/grafana/provisioning/datasources:ro"
       ],
       "env": {
         "GF_SECURITY_ADMIN_PASSWORD__FILE": "/run/secrets/admin"
@@ -131,7 +147,10 @@
   "requires": [
     "route",
     "oidc-client",
-    "influxdb-api"
+    {
+      "name": "influxdb-api",
+      "optional": true
+    }
   ],
   "contributes": {
     "route": {