From 34fbf0285a2e03c296417a45eddb96ddde13a598 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Mon, 25 May 2026 15:21:58 +0200
Subject: [PATCH] nixos/lix: load tun kmod for pasta

With kernel lockdown the tun kmod is not necessarily available in stage2,
but Lix dependes on it through pasta.

nix-daemon[682677]: remote pid 682659 is user build (trusted)
nix-daemon[682711]: Failed to open() /dev/net/tun: No such device
nix-daemon[682702]: Failed to set up tap device in namespace
---
 nixos/modules/programs/lix.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/nixos/modules/programs/lix.nix b/nixos/modules/programs/lix.nix
index d87ff84eafba..44402ac00ca3 100644
--- a/nixos/modules/programs/lix.nix
+++ b/nixos/modules/programs/lix.nix
@@ -47,6 +47,9 @@ in
 
 {
   config = lib.mkIf (cfg.enable && nixPackage.pname == "lix") {
+    # Require the tun kernel module for pasta, can be disabled if pasta is not used.
+    boot.kernelModules.tun = lib.mkDefault true;
+
     environment.systemPackages = [
       nixPackage
       pkgs.nix-info