nixos/systemd/tpm2/pcrextend: add Varlink API

This adds io.systemd.PCRExtend if the system has TPM2
enabled.

Additionally, this requires the system to fullfill
ConditionSecurity=measured-uki.

Change-Id: I3f1046cdc7463f3b6d3205030f7f12ac95e5cd9e
Signed-off-by: Raito Bezarius <masterancpp@gmail.com>

nixos/modules/system/boot/systemd/tpm2.nix

@@ -43,6 +43,8 @@
           "tpm2.target"
           "systemd-tpm2-setup-early.service"
           "systemd-tpm2-setup.service"
+          "systemd-pcrextend.socket"
+          "systemd-pcrextend@.service"
         ];
       }
     )
@@ -69,6 +71,8 @@
         boot.initrd.systemd.additionalUpstreamUnits = [
           "tpm2.target"
           "systemd-tpm2-setup-early.service"
+          "systemd-pcrextend.socket"
+          "systemd-pcrextend@.service"
         ];
 
         boot.initrd.availableKernelModules = [
@@ -81,6 +85,7 @@
           pkgs.tpm2-tss
           "${cfg.package}/lib/systemd/systemd-tpm2-setup"
           "${cfg.package}/lib/systemd/system-generators/systemd-tpm2-generator"
+          "${cfg.package}/lib/systemd/systemd-pcrextend"
         ];
       }
     )
@@ -89,7 +94,9 @@
         cfg = config.boot.initrd.systemd;
       in
       lib.mkIf (cfg.enable && cfg.tpm2.enable && cfg.tpm2.pcrphases.enable) {
-        boot.initrd.systemd.additionalUpstreamUnits = [ "systemd-pcrphase-initrd.service" ];
+        boot.initrd.systemd.additionalUpstreamUnits = [
+          "systemd-pcrphase-initrd.service"
+        ];
         boot.initrd.systemd.services.systemd-pcrphase-initrd.wantedBy = [ "initrd.target" ];
         boot.initrd.systemd.storePaths = [ "${cfg.package}/lib/systemd/systemd-pcrextend" ];
       }