From 1fc433dc5174ec33192b1d59f6e65c9beed7e9ef Mon Sep 17 00:00:00 2001 From: Raito Bezarius Date: Sat, 20 Jun 2026 21:35:49 +0200 Subject: [PATCH 01/11] nixos/systemd/repart: add Varlink socket This enables the ability to use systemd-repart over Varlink at /run/systemd/io.systemd.Repart. Change-Id: Ia74fdf8c2cbc4ec52994ba8ceb5796acc731abd3 Signed-off-by: Raito Bezarius --- nixos/modules/system/boot/systemd.nix | 5 +++++ nixos/modules/system/boot/systemd/repart.nix | 6 ++++++ pkgs/os-specific/linux/systemd/default.nix | 1 + 3 files changed, 12 insertions(+) diff --git a/nixos/modules/system/boot/systemd.nix b/nixos/modules/system/boot/systemd.nix index 75b4143d6810..f218863ecf05 100644 --- a/nixos/modules/system/boot/systemd.nix +++ b/nixos/modules/system/boot/systemd.nix @@ -209,6 +209,11 @@ let "dbus-org.freedesktop.portable1.service" "systemd-portabled.service" ] + ++ optionals cfg.package.withRepart [ + # Varlink APIs + "systemd-repart@.service" + "systemd-repart.socket" + ] ++ [ "systemd-exit.service" "systemd-update-done.service" diff --git a/nixos/modules/system/boot/systemd/repart.nix b/nixos/modules/system/boot/systemd/repart.nix index fce8e417991d..2126464c5250 100644 --- a/nixos/modules/system/boot/systemd/repart.nix +++ b/nixos/modules/system/boot/systemd/repart.nix @@ -157,6 +157,12 @@ in boot.initrd.systemd = lib.mkIf initrdCfg.enable { additionalUpstreamUnits = [ "systemd-repart.service" + # Varlink APIs + # NOTE: compared to stage 2 where the IPC is enabled in the global location, initrd + # might be optimized to keep away the repart binary. + # As a result, we enable repart IPC in the initrd only if repart is enabled in the initrd. + "systemd-repart.socket" + "systemd-repart@.service" ]; storePaths = [ diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix index f0fb666cd8de..47dc60f1d20b 100644 --- a/pkgs/os-specific/linux/systemd/default.nix +++ b/pkgs/os-specific/linux/systemd/default.nix @@ -703,6 +703,7 @@ stdenv.mkDerivation (finalAttrs: { withMachined withNetworkd withNspawn + withRepart withPortabled withSysupdate withTimedated From 7dacd14febf4c7b8247ce2033e9bcf0faadae76a Mon Sep 17 00:00:00 2001 From: Raito Bezarius Date: Sat, 20 Jun 2026 21:43:24 +0200 Subject: [PATCH 02/11] nixos/systemd/ask-password: add Varlink API This adds io.systemd.AskPassword Varlink API by default. Change-Id: I45b9a53d489ec3ea5561006c9c91ccb7016b3ee1 Signed-off-by: Raito Bezarius --- nixos/modules/system/boot/systemd.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/nixos/modules/system/boot/systemd.nix b/nixos/modules/system/boot/systemd.nix index f218863ecf05..ee6a64189c46 100644 --- a/nixos/modules/system/boot/systemd.nix +++ b/nixos/modules/system/boot/systemd.nix @@ -157,6 +157,8 @@ let "systemd-ask-password-wall.service" # Varlink APIs + "systemd-ask-password@.service" + "systemd-ask-password.socket" ] ++ lib.optionals cfg.package.withBootloader [ "systemd-bootctl@.service" From 3003651b5ab140b6287de122cebdd7098890d60a Mon Sep 17 00:00:00 2001 From: Raito Bezarius Date: Sat, 20 Jun 2026 21:43:55 +0200 Subject: [PATCH 03/11] nixos/systemd/importd: add Varlink API This adds io.systemd.Import by default. Change-Id: Idad216f83af2f3402b864a162373f04968725b7b Signed-off-by: Raito Bezarius --- nixos/modules/system/boot/systemd.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/nixos/modules/system/boot/systemd.nix b/nixos/modules/system/boot/systemd.nix index ee6a64189c46..81acb33df53b 100644 --- a/nixos/modules/system/boot/systemd.nix +++ b/nixos/modules/system/boot/systemd.nix @@ -180,6 +180,7 @@ let ] ++ optionals cfg.package.withImportd [ "systemd-importd.service" + "systemd-importd.socket" ] ++ optionals cfg.package.withMachined [ "machine.slice" From ff55fdd00331493823ddd2fad7d898ed70d9ac13 Mon Sep 17 00:00:00 2001 From: Raito Bezarius Date: Sat, 20 Jun 2026 21:44:30 +0200 Subject: [PATCH 04/11] nixos/systemd/machined: add Varlink API This adds io.systemd.Machine by default. Change-Id: I05e595d22ad06504e2b3aacb48c74e7683057ce3 Signed-off-by: Raito Bezarius --- nixos/modules/system/boot/systemd.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/nixos/modules/system/boot/systemd.nix b/nixos/modules/system/boot/systemd.nix index 81acb33df53b..41ccdcd0e4bb 100644 --- a/nixos/modules/system/boot/systemd.nix +++ b/nixos/modules/system/boot/systemd.nix @@ -186,6 +186,7 @@ let "machine.slice" "machines.target" "systemd-machined.service" + "systemd-machined.socket" ] ++ optionals cfg.package.withNspawn [ "systemd-nspawn@.service" From 65cdcfc1331469f005923fd2dcbe305348f76631 Mon Sep 17 00:00:00 2001 From: Raito Bezarius Date: Sat, 20 Jun 2026 21:44:55 +0200 Subject: [PATCH 05/11] nixos/systemd/mute-console: add Varlink API This adds io.systemd.MuteConsole by default. Change-Id: I613d5f12e5b2742206c3023e4d57ccdfbaf0e704 Signed-off-by: Raito Bezarius --- nixos/modules/system/boot/systemd.nix | 3 +++ 1 file changed, 3 insertions(+) diff --git a/nixos/modules/system/boot/systemd.nix b/nixos/modules/system/boot/systemd.nix index 41ccdcd0e4bb..71b166b998a9 100644 --- a/nixos/modules/system/boot/systemd.nix +++ b/nixos/modules/system/boot/systemd.nix @@ -195,6 +195,9 @@ let # Misc. "systemd-sysctl.service" "systemd-machine-id-commit.service" + + "systemd-mute-console@.service" + "systemd-mute-console.socket" ] ++ optionals cfg.package.withTimedated [ "dbus-org.freedesktop.timedate1.service" From b8b65f1616d2b913f82324344315937650adae58 Mon Sep 17 00:00:00 2001 From: Raito Bezarius Date: Sat, 20 Jun 2026 21:45:16 +0200 Subject: [PATCH 06/11] nixos/systemd/factory-reset: add Varlink API This adds io.systemd.FactoryReset by default. Change-Id: I2ef8ae8812e76bc81a5f962e9bfeb99967f6df83 Signed-off-by: Raito Bezarius --- nixos/modules/system/boot/systemd.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/nixos/modules/system/boot/systemd.nix b/nixos/modules/system/boot/systemd.nix index 71b166b998a9..4149cda3e1e5 100644 --- a/nixos/modules/system/boot/systemd.nix +++ b/nixos/modules/system/boot/systemd.nix @@ -233,6 +233,8 @@ let "factory-reset.target" "systemd-factory-reset-request.service" "systemd-factory-reset-reboot.service" + "systemd-factory-reset@.service" + "systemd-factory-reset.socket" ] ++ cfg.additionalUpstreamSystemUnits; From 04f7553ac2a5ecd6f01f3811eee6cabbbea8a8c7 Mon Sep 17 00:00:00 2001 From: Raito Bezarius Date: Sat, 20 Jun 2026 21:49:52 +0200 Subject: [PATCH 07/11] nixos/systemd/networkd: add Varlink APIs This adds: - /run/systemd/resolve.hook/io.systemd.Network (DNS hook) - /run/systemd/report/io.systemd.Network (metrics) - /run/systemd/netif/io.systemd.Network (management) Change-Id: I3d63b0723ae5f8f9496418d8f5d857809302155e Signed-off-by: Raito Bezarius --- nixos/modules/system/boot/networkd.nix | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/nixos/modules/system/boot/networkd.nix b/nixos/modules/system/boot/networkd.nix index 2b14caac86fa..4a22d6585eb9 100644 --- a/nixos/modules/system/boot/networkd.nix +++ b/nixos/modules/system/boot/networkd.nix @@ -4231,8 +4231,10 @@ let "systemd-networkd-wait-online@.service" "systemd-networkd.service" "systemd-networkd.socket" - "systemd-networkd-persistent-storage.service" + "systemd-networkd-resolve-hook.socket" "systemd-networkd-varlink-metrics.socket" + "systemd-networkd-varlink.socket" + "systemd-networkd-persistent-storage.service" ]; systemd.sockets.systemd-networkd-varlink-metrics.wantedBy = [ "sockets.target" ]; @@ -4314,6 +4316,9 @@ let systemd.additionalUpstreamUnits = [ "systemd-networkd-wait-online.service" "systemd-networkd.service" + "systemd-networkd-resolve-hook.socket" + "systemd-networkd-varlink-metrics.socket" + "systemd-networkd-varlink.socket" "systemd-networkd.socket" "systemd-network-generator.service" "network-online.target" From 5c6a1e2b3d5a79cea0e4941ebaffef9226cccd28 Mon Sep 17 00:00:00 2001 From: Raito Bezarius Date: Sat, 20 Jun 2026 21:51:05 +0200 Subject: [PATCH 08/11] nixos/systemd/udevd: add Varlink API This adds io.systemd.Udev by default. Change-Id: I41fec3831049aec03041a9ac8a282088e1773b79 Signed-off-by: Raito Bezarius --- nixos/modules/system/boot/systemd.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/nixos/modules/system/boot/systemd.nix b/nixos/modules/system/boot/systemd.nix index 4149cda3e1e5..acfb213b98e0 100644 --- a/nixos/modules/system/boot/systemd.nix +++ b/nixos/modules/system/boot/systemd.nix @@ -65,6 +65,7 @@ let # Udev. "systemd-udevd-control.socket" "systemd-udevd-kernel.socket" + "systemd-udevd-varlink.socket" "systemd-udevd.service" ] ++ (optional (!config.boot.isContainer) "systemd-udev-trigger.service") From 13684b8470a62303a3659b759a44fc2eb1112664 Mon Sep 17 00:00:00 2001 From: Raito Bezarius Date: Sat, 20 Jun 2026 21:52:02 +0200 Subject: [PATCH 09/11] nixos/systemd/resolved: add Varlink APIs This adds: - /run/systemd/resolve/io.systemd.Resolve (resolution) - /run/systemd/resolve/io.systemd.Resolve.Monitor (monitoring) Change-Id: I43f22be5c42757f3dad1e4a9d209b0a91f404a55 Signed-off-by: Raito Bezarius --- nixos/modules/system/boot/resolved.nix | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/nixos/modules/system/boot/resolved.nix b/nixos/modules/system/boot/resolved.nix index da2b57285a76..6760dab044e9 100644 --- a/nixos/modules/system/boot/resolved.nix +++ b/nixos/modules/system/boot/resolved.nix @@ -185,7 +185,11 @@ in # added with order 501 to allow modules to go before with mkBefore system.nssDatabases.hosts = (mkOrder 501 [ "resolve [!UNAVAIL=return]" ]); - systemd.additionalUpstreamSystemUnits = [ "systemd-resolved.service" ]; + systemd.additionalUpstreamSystemUnits = [ + "systemd-resolved.service" + "systemd-resolved-monitor.socket" + "systemd-resolved-varlink.socket" + ]; systemd.services.systemd-resolved = { wantedBy = [ "sysinit.target" ]; @@ -248,7 +252,12 @@ in tmpfiles.settings.systemd-resolved-stub."/etc/resolv.conf".L.argument = "/run/systemd/resolve/stub-resolv.conf"; - additionalUpstreamUnits = [ "systemd-resolved.service" ]; + additionalUpstreamUnits = [ + "systemd-resolved.service" + "systemd-resolved-monitor.socket" + "systemd-resolved-varlink.socket" + ]; + users.systemd-resolve = { }; groups.systemd-resolve = { }; storePaths = [ "${config.boot.initrd.systemd.package}/lib/systemd/systemd-resolved" ]; From 588eb06fccd1087ecbcff36bfa9da229b1fbf9be Mon Sep 17 00:00:00 2001 From: Raito Bezarius Date: Sat, 20 Jun 2026 21:53:21 +0200 Subject: [PATCH 10/11] nixos/systemd/tpm2/pcrextend: add Varlink API This adds io.systemd.PCRExtend if the system has TPM2 enabled. Additionally, this requires the system to fullfill ConditionSecurity=measured-uki. Change-Id: I3f1046cdc7463f3b6d3205030f7f12ac95e5cd9e Signed-off-by: Raito Bezarius --- nixos/modules/system/boot/systemd/tpm2.nix | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/nixos/modules/system/boot/systemd/tpm2.nix b/nixos/modules/system/boot/systemd/tpm2.nix index 2703d60428f1..de0f72e5a543 100644 --- a/nixos/modules/system/boot/systemd/tpm2.nix +++ b/nixos/modules/system/boot/systemd/tpm2.nix @@ -43,6 +43,8 @@ "tpm2.target" "systemd-tpm2-setup-early.service" "systemd-tpm2-setup.service" + "systemd-pcrextend.socket" + "systemd-pcrextend@.service" ]; } ) @@ -69,6 +71,8 @@ boot.initrd.systemd.additionalUpstreamUnits = [ "tpm2.target" "systemd-tpm2-setup-early.service" + "systemd-pcrextend.socket" + "systemd-pcrextend@.service" ]; boot.initrd.availableKernelModules = [ @@ -81,6 +85,7 @@ pkgs.tpm2-tss "${cfg.package}/lib/systemd/systemd-tpm2-setup" "${cfg.package}/lib/systemd/system-generators/systemd-tpm2-generator" + "${cfg.package}/lib/systemd/systemd-pcrextend" ]; } ) @@ -89,7 +94,9 @@ cfg = config.boot.initrd.systemd; in lib.mkIf (cfg.enable && cfg.tpm2.enable && cfg.tpm2.pcrphases.enable) { - boot.initrd.systemd.additionalUpstreamUnits = [ "systemd-pcrphase-initrd.service" ]; + boot.initrd.systemd.additionalUpstreamUnits = [ + "systemd-pcrphase-initrd.service" + ]; boot.initrd.systemd.services.systemd-pcrphase-initrd.wantedBy = [ "initrd.target" ]; boot.initrd.systemd.storePaths = [ "${cfg.package}/lib/systemd/systemd-pcrextend" ]; } From 7a95244dd85e6d721ac568717bd8e792668b17f5 Mon Sep 17 00:00:00 2001 From: Raito Bezarius Date: Sat, 20 Jun 2026 22:41:38 +0200 Subject: [PATCH 11/11] nixos/tests/systemd-varlink: init This maintains the fact that some IPCs are now observed and becomes "public API" in NixOS as long as systemd makes them public APIs. This can be generalized to a generic public-varlink-apis test once other vendors obtains APIs which are defacto in the system, e.g. NixOS's IPCs. Change-Id: I182965b0cd043b55bc7bbab572c9f0d50142eda9 Signed-off-by: Raito Bezarius --- nixos/tests/all-tests.nix | 1 + nixos/tests/systemd-varlink.nix | 46 +++++++++++++++++++++++++++++++++ 2 files changed, 47 insertions(+) create mode 100644 nixos/tests/systemd-varlink.nix diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix index 93ec2703c3e5..23d4b14284ba 100644 --- a/nixos/tests/all-tests.nix +++ b/nixos/tests/all-tests.nix @@ -1676,6 +1676,7 @@ in systemd-user-settings = runTest ./systemd-user-settings.nix; systemd-user-tmpfiles-rules = runTest ./systemd-user-tmpfiles-rules.nix; systemd-userdbd = runTest ./systemd-userdbd.nix; + systemd-varlink = runTest ./systemd-varlink.nix; systemtap = handleTest ./systemtap.nix { }; szurubooru = handleTest ./szurubooru.nix { }; taler = handleTest ./taler { }; diff --git a/nixos/tests/systemd-varlink.nix b/nixos/tests/systemd-varlink.nix new file mode 100644 index 000000000000..df5d7cbb73a3 --- /dev/null +++ b/nixos/tests/systemd-varlink.nix @@ -0,0 +1,46 @@ +{ lib, ... }: +{ + name = "systemd-varlink"; + meta.maintainers = [ lib.maintainers.raitobezarius ]; + nodes.machine = + { config, pkgs, ... }: + { + networking.useNetworkd = true; + services.resolved.enable = true; + systemd.network.enable = true; + }; + testScript = '' + def list_interfaces(intf_path: str) -> list[str]: + return machine.succeed(f"varlinkctl list-interfaces {intf_path}").split('\n') + + expected_reg_sd_interfaces = [ + ("BootControl", "bootctl"), + ("Credentials", "creds"), + ("Hostname", "hostnamed"), + ("JournalAccess", "journald"), + ("Import", "importd"), + ("Machine", "machined"), + ("Resolve", "resolved-varlink"), + ("Resolve.Monitor", "resolved-monitor"), + ("Udev", "udevd-varlink"), + ("MuteConsole", "mute-console"), + ("FactoryReset", "factory-reset"), + ("AskPassword", "ask-password"), + ("Network", "networkd-varlink"), + ("Repart", "repart"), + ] + expected_priv_sd_interfaces = [ + ("Login", None), # systemd-logind-varlink.socket exist but is not necessary. + ] + expected_interfaces = [ + (f"io.systemd.{intf}", f"systemd-{socket_name}", f"/run/varlink/registry/io.systemd.{intf}") for intf, socket_name in expected_reg_sd_interfaces + ] + [ + (f"io.systemd.{intf}", f"systemd-{socket_name}" if socket_name is not None else None, f"/run/systemd/io.systemd.{intf}") for intf, socket_name in expected_priv_sd_interfaces + ] + + for intf, socket_name, intf_path in expected_interfaces: + if socket_name is not None: + machine.wait_for_unit(f"{socket_name}.socket") + assert intf in list_interfaces(intf_path), f"Interface '{intf}' not found in the Varlink registry" + ''; +}