nixos/systemd-user: add systemd.user.tmpfiles.enable

enabled by default, see #391976

nixos/modules/system/boot/systemd/user.nix

@@ -12,9 +12,6 @@ with lib;
 let
   cfg = config.systemd.user;
 
-  hasTmpfiles =
-    cfg.tmpfiles.rules != [ ] || any (cfg': cfg'.rules != [ ]) (attrValues cfg.tmpfiles.users);
-
   systemd = config.systemd.package;
 
   inherit (systemdUtils.lib)
@@ -123,6 +120,13 @@ in
     };
 
     systemd.user.tmpfiles = {
+      enable =
+        (mkEnableOption "systemd user units systemd-tmpfiles-setup.service and systemd-tmpfiles-clean.timer")
+        // {
+          default = true;
+          example = false;
+        };
+
       rules = mkOption {
         type = types.listOf types.str;
         default = [ ];
@@ -215,7 +219,7 @@ in
 
     systemd.user.timers = {
       # enable systemd user tmpfiles
-      systemd-tmpfiles-clean.wantedBy = optional hasTmpfiles "timers.target";
+      systemd-tmpfiles-clean.wantedBy = optional cfg.tmpfiles.enable "timers.target";
     }
     # Generate timer units for all services that have a ‘startAt’ value.
     // (mapAttrs (name: service: {
@@ -240,7 +244,7 @@ in
     systemd.services.systemd-user-sessions.restartIfChanged = false; # Restart kills all active sessions.
 
     # enable systemd user tmpfiles
-    systemd.user.services.systemd-tmpfiles-setup.wantedBy = optional hasTmpfiles "basic.target";
+    systemd.user.services.systemd-tmpfiles-setup.wantedBy = optional cfg.tmpfiles.enable "basic.target";
 
     # /run/current-system/sw/etc/xdg is in systemd's $XDG_CONFIG_DIRS so we can
     # write the tmpfiles.d rules for everyone there

nixos/tests/systemd-user-tmpfiles-rules.nix

@@ -6,9 +6,8 @@
     maintainers = [ schnusch ];
   };
 
-  nodes.machine =
-    { ... }:
-    {
+  nodes = rec {
+    machine = {
       users.users = {
         alice.isNormalUser = true;
         bob.isNormalUser = true;
@@ -32,6 +31,11 @@
         OnUnitActiveSec = "10s";
       };
     };
+    disabled = {
+      imports = [ machine ];
+      systemd.user.tmpfiles.enable = false;
+    };
+  };
 
   testScript =
     { ... }:
@@ -49,5 +53,12 @@
       machine.succeed("systemctl --user --machine=bob@ is-active systemd-tmpfiles-clean.timer")
       machine.succeed("runuser -u bob -- touch ~bob/cleaned_up/file")
       machine.wait_until_fails("[ -e ~bob/cleaned_up/file ]")
+
+      # disabled user tmpfiles
+      disabled.succeed("loginctl enable-linger alice bob")
+      for user in ("alice", "bob"):
+          for verb in ("is-enabled", "is-active"):
+              for unit in ("systemd-tmpfiles-setup.service", "systemd-tmpfiles-clean.timer"):
+                  disabled.fail(f"systemctl --user --machine={user}@ {verb} {unit}")
     '';
 }