nixos/systemd/tpm2: add pcrphase services (#491564)

nixos/modules/system/boot/systemd/tpm2.nix

@@ -9,19 +9,8 @@
 
   imports = [
     (lib.mkRenamedOptionModule
-      [
-        "boot"
-        "initrd"
-        "systemd"
-        "enableTpm2"
-      ]
-      [
-        "boot"
-        "initrd"
-        "systemd"
-        "tpm2"
-        "enable"
-      ]
+      [ "boot" "initrd" "systemd" "enableTpm2" ]
+      [ "boot" "initrd" "systemd" "tpm2" "enable" ]
     )
   ];
 
@@ -31,13 +20,18 @@
       defaultText = "systemd.package.withTpm2Units";
     };
 
+    systemd.tpm2.pcrphases.enable = lib.mkEnableOption "systemd boot phase measurements";
+
     boot.initrd.systemd.tpm2.enable = lib.mkEnableOption "systemd initrd TPM2 support" // {
       default = config.boot.initrd.systemd.package.withTpm2Units;
       defaultText = "boot.initrd.systemd.package.withTpm2Units";
     };
+
+    boot.initrd.systemd.tpm2.pcrphases.enable =
+      lib.mkEnableOption "systemd initrd boot phase measurements";
   };
 
-  # TODO: pcrphase, pcrextend, pcrfs, pcrmachine
+  # TODO: pcrextend, pcrfs, pcrmachine
   config = lib.mkMerge [
     # Stage 2
     (
@@ -52,6 +46,19 @@
         ];
       }
     )
+    (
+      let
+        cfg = config.systemd;
+      in
+      lib.mkIf (cfg.tpm2.enable && cfg.tpm2.pcrphases.enable) {
+        systemd.additionalUpstreamSystemUnits = [
+          "systemd-pcrphase.service"
+          "systemd-pcrphase-sysinit.service"
+        ];
+        systemd.services.systemd-pcrphase.wantedBy = [ "sysinit.target" ];
+        systemd.services.systemd-pcrphase-sysinit.wantedBy = [ "sysinit.target" ];
+      }
+    )
 
     # Stage 1
     (
@@ -77,5 +84,15 @@
         ];
       }
     )
+    (
+      let
+        cfg = config.boot.initrd.systemd;
+      in
+      lib.mkIf (cfg.enable && cfg.tpm2.enable && cfg.tpm2.pcrphases.enable) {
+        boot.initrd.systemd.additionalUpstreamUnits = [ "systemd-pcrphase-initrd.service" ];
+        boot.initrd.systemd.services.systemd-pcrphase-initrd.wantedBy = [ "initrd.target" ];
+        boot.initrd.systemd.storePaths = [ "${cfg.package}/lib/systemd/systemd-pcrextend" ];
+      }
+    )
   ];
 }