From 1ee2f0b0caeb0c126858307db96edd15ea1c64d8 Mon Sep 17 00:00:00 2001
From: Mikael Voss <mvs@nyantec.com>
Date: Tue, 10 Mar 2026 10:32:37 +0100
Subject: [PATCH] nixos/systemd: move default sysctls from coredump module
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The default systemd sysctl snippet contains various security‐relevant
settings, it is however only installed if systemd.coredump.enable is
enabled, despite these settings not being strictly related to
systemd-coredump.
---
 nixos/modules/system/boot/systemd.nix          | 2 ++
 nixos/modules/system/boot/systemd/coredump.nix | 2 --
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/nixos/modules/system/boot/systemd.nix b/nixos/modules/system/boot/systemd.nix
index c5e6b28ae78d..750a462ad868 100644
--- a/nixos/modules/system/boot/systemd.nix
+++ b/nixos/modules/system/boot/systemd.nix
@@ -667,6 +667,8 @@ in
 
         "systemd/system-environment-generators/env-generator".source =
           "${config.system.nixos-init.package}/bin/env-generator";
+
+        "sysctl.d/50-default.conf".source = "${cfg.package}/example/sysctl.d/50-default.conf";
       };
 
     services.dbus.enable = true;
diff --git a/nixos/modules/system/boot/systemd/coredump.nix b/nixos/modules/system/boot/systemd/coredump.nix
index 747258c006ca..18211b960809 100644
--- a/nixos/modules/system/boot/systemd/coredump.nix
+++ b/nixos/modules/system/boot/systemd/coredump.nix
@@ -67,8 +67,6 @@ in
               }}"
             ];
           };
-
-        "sysctl.d/50-default.conf".source = "${systemd}/example/sysctl.d/50-default.conf";
       };
 
       users.users.systemd-coredump = {