nixos/systemd: add many Varlink APIs since v260 (#533730)

nixos/modules/system/boot/networkd.nix

@@ -4231,8 +4231,10 @@ let
           "systemd-networkd-wait-online@.service"
           "systemd-networkd.service"
           "systemd-networkd.socket"
-          "systemd-networkd-persistent-storage.service"
+          "systemd-networkd-resolve-hook.socket"
           "systemd-networkd-varlink-metrics.socket"
+          "systemd-networkd-varlink.socket"
+          "systemd-networkd-persistent-storage.service"
         ];
 
         systemd.sockets.systemd-networkd-varlink-metrics.wantedBy = [ "sockets.target" ];
@@ -4314,6 +4316,9 @@ let
         systemd.additionalUpstreamUnits = [
           "systemd-networkd-wait-online.service"
           "systemd-networkd.service"
+          "systemd-networkd-resolve-hook.socket"
+          "systemd-networkd-varlink-metrics.socket"
+          "systemd-networkd-varlink.socket"
           "systemd-networkd.socket"
           "systemd-network-generator.service"
           "network-online.target"

nixos/modules/system/boot/resolved.nix

@@ -185,7 +185,11 @@ in
       # added with order 501 to allow modules to go before with mkBefore
       system.nssDatabases.hosts = (mkOrder 501 [ "resolve [!UNAVAIL=return]" ]);
 
-      systemd.additionalUpstreamSystemUnits = [ "systemd-resolved.service" ];
+      systemd.additionalUpstreamSystemUnits = [
+        "systemd-resolved.service"
+        "systemd-resolved-monitor.socket"
+        "systemd-resolved-varlink.socket"
+      ];
 
       systemd.services.systemd-resolved = {
         wantedBy = [ "sysinit.target" ];
@@ -248,7 +252,12 @@ in
         tmpfiles.settings.systemd-resolved-stub."/etc/resolv.conf".L.argument =
           "/run/systemd/resolve/stub-resolv.conf";
 
-        additionalUpstreamUnits = [ "systemd-resolved.service" ];
+        additionalUpstreamUnits = [
+          "systemd-resolved.service"
+          "systemd-resolved-monitor.socket"
+          "systemd-resolved-varlink.socket"
+        ];
+
         users.systemd-resolve = { };
         groups.systemd-resolve = { };
         storePaths = [ "${config.boot.initrd.systemd.package}/lib/systemd/systemd-resolved" ];

nixos/modules/system/boot/systemd.nix

@@ -65,6 +65,7 @@ let
     # Udev.
     "systemd-udevd-control.socket"
     "systemd-udevd-kernel.socket"
+    "systemd-udevd-varlink.socket"
     "systemd-udevd.service"
   ]
   ++ (optional (!config.boot.isContainer) "systemd-udev-trigger.service")
@@ -157,6 +158,8 @@ let
     "systemd-ask-password-wall.service"
 
     # Varlink APIs
+    "systemd-ask-password@.service"
+    "systemd-ask-password.socket"
   ]
   ++ lib.optionals cfg.package.withBootloader [
     "systemd-bootctl@.service"
@@ -178,11 +181,13 @@ let
   ]
   ++ optionals cfg.package.withImportd [
     "systemd-importd.service"
+    "systemd-importd.socket"
   ]
   ++ optionals cfg.package.withMachined [
     "machine.slice"
     "machines.target"
     "systemd-machined.service"
+    "systemd-machined.socket"
   ]
   ++ optionals cfg.package.withNspawn [
     "systemd-nspawn@.service"
@@ -191,6 +196,9 @@ let
     # Misc.
     "systemd-sysctl.service"
     "systemd-machine-id-commit.service"
+
+    "systemd-mute-console@.service"
+    "systemd-mute-console.socket"
   ]
   ++ optionals cfg.package.withTimedated [
     "dbus-org.freedesktop.timedate1.service"
@@ -209,6 +217,11 @@ let
     "dbus-org.freedesktop.portable1.service"
     "systemd-portabled.service"
   ]
+  ++ optionals cfg.package.withRepart [
+    # Varlink APIs
+    "systemd-repart@.service"
+    "systemd-repart.socket"
+  ]
   ++ [
     "systemd-exit.service"
     "systemd-update-done.service"
@@ -221,6 +234,8 @@ let
     "factory-reset.target"
     "systemd-factory-reset-request.service"
     "systemd-factory-reset-reboot.service"
+    "systemd-factory-reset@.service"
+    "systemd-factory-reset.socket"
   ]
   ++ cfg.additionalUpstreamSystemUnits;
 

nixos/modules/system/boot/systemd/repart.nix

@@ -157,6 +157,12 @@ in
     boot.initrd.systemd = lib.mkIf initrdCfg.enable {
       additionalUpstreamUnits = [
         "systemd-repart.service"
+        # Varlink APIs
+        # NOTE: compared to stage 2 where the IPC is enabled in the global location, initrd
+        # might be optimized to keep away the repart binary.
+        # As a result, we enable repart IPC in the initrd only if repart is enabled in the initrd.
+        "systemd-repart.socket"
+        "systemd-repart@.service"
       ];
 
       storePaths = [

nixos/modules/system/boot/systemd/tpm2.nix

@@ -43,6 +43,8 @@
           "tpm2.target"
           "systemd-tpm2-setup-early.service"
           "systemd-tpm2-setup.service"
+          "systemd-pcrextend.socket"
+          "systemd-pcrextend@.service"
         ];
       }
     )
@@ -69,6 +71,8 @@
         boot.initrd.systemd.additionalUpstreamUnits = [
           "tpm2.target"
           "systemd-tpm2-setup-early.service"
+          "systemd-pcrextend.socket"
+          "systemd-pcrextend@.service"
         ];
 
         boot.initrd.availableKernelModules = [
@@ -81,6 +85,7 @@
           pkgs.tpm2-tss
           "${cfg.package}/lib/systemd/systemd-tpm2-setup"
           "${cfg.package}/lib/systemd/system-generators/systemd-tpm2-generator"
+          "${cfg.package}/lib/systemd/systemd-pcrextend"
         ];
       }
     )
@@ -89,7 +94,9 @@
         cfg = config.boot.initrd.systemd;
       in
       lib.mkIf (cfg.enable && cfg.tpm2.enable && cfg.tpm2.pcrphases.enable) {
-        boot.initrd.systemd.additionalUpstreamUnits = [ "systemd-pcrphase-initrd.service" ];
+        boot.initrd.systemd.additionalUpstreamUnits = [
+          "systemd-pcrphase-initrd.service"
+        ];
         boot.initrd.systemd.services.systemd-pcrphase-initrd.wantedBy = [ "initrd.target" ];
         boot.initrd.systemd.storePaths = [ "${cfg.package}/lib/systemd/systemd-pcrextend" ];
       }

nixos/tests/all-tests.nix

@@ -1695,6 +1695,7 @@ in
   systemd-user-settings = runTest ./systemd-user-settings.nix;
   systemd-user-tmpfiles-rules = runTest ./systemd-user-tmpfiles-rules.nix;
   systemd-userdbd = runTest ./systemd-userdbd.nix;
+  systemd-varlink = runTest ./systemd-varlink.nix;
   systemtap = handleTest ./systemtap.nix { };
   szurubooru = handleTest ./szurubooru.nix { };
   taler = handleTest ./taler { };

nixos/tests/systemd-varlink.nix

@@ -0,0 +1,46 @@
+{ lib, ... }:
+{
+  name = "systemd-varlink";
+  meta.maintainers = [ lib.maintainers.raitobezarius ];
+  nodes.machine =
+    { config, pkgs, ... }:
+    {
+      networking.useNetworkd = true;
+      services.resolved.enable = true;
+      systemd.network.enable = true;
+    };
+  testScript = ''
+    def list_interfaces(intf_path: str) -> list[str]:
+      return machine.succeed(f"varlinkctl list-interfaces {intf_path}").split('\n')
+
+    expected_reg_sd_interfaces = [
+      ("BootControl", "bootctl"),
+      ("Credentials", "creds"),
+      ("Hostname", "hostnamed"),
+      ("JournalAccess", "journald"),
+      ("Import", "importd"),
+      ("Machine", "machined"),
+      ("Resolve", "resolved-varlink"),
+      ("Resolve.Monitor", "resolved-monitor"),
+      ("Udev", "udevd-varlink"),
+      ("MuteConsole", "mute-console"),
+      ("FactoryReset", "factory-reset"),
+      ("AskPassword", "ask-password"),
+      ("Network", "networkd-varlink"),
+      ("Repart", "repart"),
+    ]
+    expected_priv_sd_interfaces = [
+      ("Login", None), # systemd-logind-varlink.socket exist but is not necessary.
+    ]
+    expected_interfaces = [
+      (f"io.systemd.{intf}", f"systemd-{socket_name}", f"/run/varlink/registry/io.systemd.{intf}") for intf, socket_name in expected_reg_sd_interfaces
+    ] + [
+      (f"io.systemd.{intf}", f"systemd-{socket_name}" if socket_name is not None else None, f"/run/systemd/io.systemd.{intf}") for intf, socket_name in expected_priv_sd_interfaces
+    ]
+
+    for intf, socket_name, intf_path in expected_interfaces:
+      if socket_name is not None:
+        machine.wait_for_unit(f"{socket_name}.socket")
+      assert intf in list_interfaces(intf_path), f"Interface '{intf}' not found in the Varlink registry"
+  '';
+}

pkgs/os-specific/linux/systemd/default.nix

@@ -703,6 +703,7 @@ stdenv.mkDerivation (finalAttrs: {
       withMachined
       withNetworkd
       withNspawn
+      withRepart
       withPortabled
       withSysupdate
       withTimedated