From 26dbb73c9ddeb1bb07ac1da880183ced6f9fe49b Mon Sep 17 00:00:00 2001
From: Tert0 <tert0byte@gmail.com>
Date: Wed, 18 Feb 2026 00:15:40 +0100
Subject: [PATCH] nixos/systemd/tpm2: add pcrphase services

---
 nixos/modules/system/boot/systemd/tpm2.nix | 45 +++++++++++++++-------
 1 file changed, 31 insertions(+), 14 deletions(-)

diff --git a/nixos/modules/system/boot/systemd/tpm2.nix b/nixos/modules/system/boot/systemd/tpm2.nix
index dcdd08b24783..2703d60428f1 100644
--- a/nixos/modules/system/boot/systemd/tpm2.nix
+++ b/nixos/modules/system/boot/systemd/tpm2.nix
@@ -9,19 +9,8 @@
 
   imports = [
     (lib.mkRenamedOptionModule
-      [
-        "boot"
-        "initrd"
-        "systemd"
-        "enableTpm2"
-      ]
-      [
-        "boot"
-        "initrd"
-        "systemd"
-        "tpm2"
-        "enable"
-      ]
+      [ "boot" "initrd" "systemd" "enableTpm2" ]
+      [ "boot" "initrd" "systemd" "tpm2" "enable" ]
     )
   ];
 
@@ -31,13 +20,18 @@
       defaultText = "systemd.package.withTpm2Units";
     };
 
+    systemd.tpm2.pcrphases.enable = lib.mkEnableOption "systemd boot phase measurements";
+
     boot.initrd.systemd.tpm2.enable = lib.mkEnableOption "systemd initrd TPM2 support" // {
       default = config.boot.initrd.systemd.package.withTpm2Units;
       defaultText = "boot.initrd.systemd.package.withTpm2Units";
     };
+
+    boot.initrd.systemd.tpm2.pcrphases.enable =
+      lib.mkEnableOption "systemd initrd boot phase measurements";
   };
 
-  # TODO: pcrphase, pcrextend, pcrfs, pcrmachine
+  # TODO: pcrextend, pcrfs, pcrmachine
   config = lib.mkMerge [
     # Stage 2
     (
@@ -52,6 +46,19 @@
         ];
       }
     )
+    (
+      let
+        cfg = config.systemd;
+      in
+      lib.mkIf (cfg.tpm2.enable && cfg.tpm2.pcrphases.enable) {
+        systemd.additionalUpstreamSystemUnits = [
+          "systemd-pcrphase.service"
+          "systemd-pcrphase-sysinit.service"
+        ];
+        systemd.services.systemd-pcrphase.wantedBy = [ "sysinit.target" ];
+        systemd.services.systemd-pcrphase-sysinit.wantedBy = [ "sysinit.target" ];
+      }
+    )
 
     # Stage 1
     (
@@ -77,5 +84,15 @@
         ];
       }
     )
+    (
+      let
+        cfg = config.boot.initrd.systemd;
+      in
+      lib.mkIf (cfg.enable && cfg.tpm2.enable && cfg.tpm2.pcrphases.enable) {
+        boot.initrd.systemd.additionalUpstreamUnits = [ "systemd-pcrphase-initrd.service" ];
+        boot.initrd.systemd.services.systemd-pcrphase-initrd.wantedBy = [ "initrd.target" ];
+        boot.initrd.systemd.storePaths = [ "${cfg.package}/lib/systemd/systemd-pcrextend" ];
+      }
+    )
   ];
 }