From 7a6c67e796c40ea0cf35844ef6840324138e31bb Mon Sep 17 00:00:00 2001
From: Franz Pletz <fpletz@fnordicwalking.de>
Date: Fri, 13 Jun 2025 19:21:13 +0200
Subject: [PATCH 1/2] nixos/chrony: add systemd service notify support

---
 nixos/modules/services/networking/ntp/chrony.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nixos/modules/services/networking/ntp/chrony.nix b/nixos/modules/services/networking/ntp/chrony.nix
index 3a9d911b8048..1c752b45872f 100644
--- a/nixos/modules/services/networking/ntp/chrony.nix
+++ b/nixos/modules/services/networking/ntp/chrony.nix
@@ -237,7 +237,7 @@ in
 
       unitConfig.ConditionCapability = "CAP_SYS_TIME";
       serviceConfig = {
-        Type = "simple";
+        Type = "notify";
         ExecStart = "${chronyPkg}/bin/chronyd ${builtins.toString chronyFlags}";
 
         # Proc filesystem

From b333d6071066871c98839e5217998804a5743c6f Mon Sep 17 00:00:00 2001
From: Franz Pletz <fpletz@fnordicwalking.de>
Date: Sat, 14 Jun 2025 16:56:34 +0200
Subject: [PATCH 2/2] nixos/tests/chrony: not compatible with graphene-hardened
 anymore

Version 4.7 introduced the incompatibility, see #416005.
---
 nixos/modules/services/networking/ntp/chrony.nix | 7 +++++++
 nixos/tests/chrony.nix                           | 1 -
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/nixos/modules/services/networking/ntp/chrony.nix b/nixos/modules/services/networking/ntp/chrony.nix
index 1c752b45872f..dcfd211470d6 100644
--- a/nixos/modules/services/networking/ntp/chrony.nix
+++ b/nixos/modules/services/networking/ntp/chrony.nix
@@ -318,6 +318,13 @@ in
           Alternatively, disable this behaviour by `services.chrony.enableRTCTrimming = false;`
         '';
       }
+      {
+        assertion = !(cfg.enable && config.environment.memoryAllocator.provider == "graphene-hardened");
+        message = ''
+          Chrony doesn't work with the graphene-hardened memory allocator set by
+          `environment.memoryAllocator.provider`.
+        '';
+      }
     ];
   };
 }
diff --git a/nixos/tests/chrony.nix b/nixos/tests/chrony.nix
index e3999596fd22..88c75d5648d0 100644
--- a/nixos/tests/chrony.nix
+++ b/nixos/tests/chrony.nix
@@ -13,7 +13,6 @@ import ./make-test-python.nix (
 
         specialisation.hardened.configuration = {
           services.chrony.enableMemoryLocking = true;
-          environment.memoryAllocator.provider = "graphene-hardened";
         };
       };
     };