Seeking advice on how to fix ddclient service dependencies

When using ddclient (perhaps relevant: on a system with impermanence I get a crash when the service first runs after boot:

Jan 11 14:56:30 pizza systemd[1]: Starting Dynamic DNS Client...
Jan 11 14:56:30 pizza 1x355jwizf9m35dx36bx8769n8pwyhg6-ddclient-prestart[1817]: install: invalid user 'ddclient'
Jan 11 14:56:30 pizza 1x355jwizf9m35dx36bx8769n8pwyhg6-ddclient-prestart[1819]: Traceback (most recent call last):
Jan 11 14:56:30 pizza 1x355jwizf9m35dx36bx8769n8pwyhg6-ddclient-prestart[1819]:   File "/nix/store/wkx756xnsz4l7zvhvavvzlqfl0iy01ry-replace-secret/bin/replace-secret", line 22, in <module>
Jan 11 14:56:30 pizza 1x355jwizf9m35dx36bx8769n8pwyhg6-ddclient-prestart[1819]:     with open(args.secret_file) as sf, open(args.file, 'r+') as f:
Jan 11 14:56:30 pizza 1x355jwizf9m35dx36bx8769n8pwyhg6-ddclient-prestart[1819]:                                        ~~~~^^^^^^^^^^^^^^^^^
Jan 11 14:56:30 pizza 1x355jwizf9m35dx36bx8769n8pwyhg6-ddclient-prestart[1819]: FileNotFoundError: [Errno 2] No such file or directory: '/run/ddclient/ddclient.conf'
Jan 11 14:56:30 pizza systemd[1]: ddclient.service: Control process exited, code=exited, status=1/FAILURE

What’s going on here is:

  1. The ExecStartPre generates a config file in the runtime directory
  2. This fails because of invalid user 'ddclient'
  3. So then the service fails coz there’s no config file

I find that the issue goes away if I add nss-user-lookup.target to systemd.services.ddclient.after.

Docs for that say:

A target that should be used as synchronization point for all regular UNIX user/group name service lookups. […] Note that this unit is only relevant for regular users and groups — system users and groups are required to be resolvable during earliest boot already, and hence do not need any special ordering against this target.

I think that ddclient is a system user so depending on this target only fixes this “by accident”.

If I depend on nscd.service, that also works, but again I’m not sure if that is a “real fix” since I think nscd is just a “cache”? Also, I think it’s an “implementation detail” and it would be “wrong” for ddclient to depend on that detail here.

I’m afraid I’m running up against the limits of my systemd and system knowledge here. I wonder if anyone here knows the “correct” way to fix this?

Alternatively, is this perhaps not a bug in the ddclient package but something broken in my system?