From b13891782fdec1b72e1e9ab4f86fce1638f20203 Mon Sep 17 00:00:00 2001 From: nikstur Date: Mon, 2 Feb 2026 23:49:00 +0100 Subject: [PATCH 1/3] nixos/tests: fix luks tests to not rely on autoFormat This was testing something very odd where we created an empty luks volume and only created a fs inside the luks volume on first boot when opening it. This in fact is not possible without patching systemd and indeed it shouldn't be. This change makes the creation of the luks volumes more "normal" by also opening them and creating an fs inside. This will allow us to drop systemd/0001-Start-device-units-for-uninitialised-encrypted-devic.patch --- nixos/tests/initrd-luks-empty-passphrase.nix | 5 ++--- nixos/tests/luks.nix | 6 +++++- nixos/tests/systemd-initrd-luks-keyfile.nix | 3 ++- nixos/tests/systemd-initrd-luks-password.nix | 5 ++++- nixos/tests/systemd-initrd-luks-tpm2.nix | 3 ++- nixos/tests/systemd-initrd-luks-unl0kr.nix | 5 ++++- 6 files changed, 19 insertions(+), 8 deletions(-) diff --git a/nixos/tests/initrd-luks-empty-passphrase.nix b/nixos/tests/initrd-luks-empty-passphrase.nix index 47215c4bc998..3a906685f0ca 100644 --- a/nixos/tests/initrd-luks-empty-passphrase.nix +++ b/nixos/tests/initrd-luks-empty-passphrase.nix @@ -19,8 +19,6 @@ in nodes.machine = { pkgs, ... }: { - imports = lib.optionals (!systemdStage1) [ ./common/auto-format-root-device.nix ]; - virtualisation = { emptyDiskImages = [ 512 ]; useBootLoader = true; @@ -30,7 +28,6 @@ in # the new root device is /dev/vdb # an empty 512MiB drive, containing no Nix store. mountHostNixStore = true; - fileSystems."/".autoFormat = lib.mkIf systemdStage1 true; }; boot.loader.systemd-boot.enable = true; @@ -90,6 +87,8 @@ in # Create encrypted volume machine.wait_for_unit("multi-user.target") machine.succeed("echo "" | cryptsetup luksFormat /dev/vdb --batch-mode") + machine.succeed("echo "" | cryptsetup luksOpen /dev/vdb cryptroot") + machine.succeed("mkfs.ext4 /dev/mapper/cryptroot") machine.succeed("bootctl set-default nixos-generation-1-specialisation-boot-luks-wrong-keyfile.conf") machine.succeed("sync") machine.crash() diff --git a/nixos/tests/luks.nix b/nixos/tests/luks.nix index 685643c4c9dc..7440d110ad28 100644 --- a/nixos/tests/luks.nix +++ b/nixos/tests/luks.nix @@ -5,7 +5,6 @@ nodes.machine = { pkgs, ... }: { - imports = [ ./common/auto-format-root-device.nix ]; # Use systemd-boot virtualisation = { @@ -48,7 +47,12 @@ # Create encrypted volume machine.wait_for_unit("multi-user.target") machine.succeed("echo -n supersecret | cryptsetup luksFormat -q --iter-time=1 /dev/vdb -") + machine.succeed("echo -n supersecret | cryptsetup luksOpen -q /dev/vdb cryptroot") + machine.succeed("mkfs.ext4 /dev/mapper/cryptroot") + machine.succeed("echo -n supersecret | cryptsetup luksFormat -q --iter-time=1 /dev/vdc -") + machine.succeed("echo -n supersecret | cryptsetup luksOpen -q /dev/vdc cryptroot2") + machine.succeed("mkfs.ext4 /dev/mapper/cryptroot2") # Boot from the encrypted disk machine.succeed("bootctl set-default nixos-generation-1-specialisation-boot-luks.conf") diff --git a/nixos/tests/systemd-initrd-luks-keyfile.nix b/nixos/tests/systemd-initrd-luks-keyfile.nix index 3723307946dd..8b7f28947f72 100644 --- a/nixos/tests/systemd-initrd-luks-keyfile.nix +++ b/nixos/tests/systemd-initrd-luks-keyfile.nix @@ -38,7 +38,6 @@ in }; }; virtualisation.rootDevice = "/dev/mapper/cryptroot"; - virtualisation.fileSystems."/".autoFormat = true; boot.initrd.secrets."/etc/cryptroot.key" = keyfile; }; }; @@ -47,6 +46,8 @@ in # Create encrypted volume machine.wait_for_unit("multi-user.target") machine.succeed("cryptsetup luksFormat -q --iter-time=1 -d ${keyfile} /dev/vdb") + machine.succeed("cryptsetup luksOpen --key-file ${keyfile} /dev/vdb cryptroot") + machine.succeed("mkfs.ext4 /dev/mapper/cryptroot") # Boot from the encrypted disk machine.succeed("bootctl set-default nixos-generation-1-specialisation-boot-luks.conf") diff --git a/nixos/tests/systemd-initrd-luks-password.nix b/nixos/tests/systemd-initrd-luks-password.nix index 0f7c2f51a034..4e059f514257 100644 --- a/nixos/tests/systemd-initrd-luks-password.nix +++ b/nixos/tests/systemd-initrd-luks-password.nix @@ -31,7 +31,6 @@ cryptroot2.device = "/dev/vdc"; }; virtualisation.rootDevice = "/dev/mapper/cryptroot"; - virtualisation.fileSystems."/".autoFormat = true; # test mounting device unlocked in initrd after switching root virtualisation.fileSystems."/cryptroot2".device = "/dev/mapper/cryptroot2"; }; @@ -40,7 +39,11 @@ testScript = '' # Create encrypted volume machine.wait_for_unit("multi-user.target") + machine.succeed("echo -n supersecret | cryptsetup luksFormat -q --iter-time=1 /dev/vdb -") + machine.succeed("echo -n supersecret | cryptsetup luksOpen -q /dev/vdb cryptroot") + machine.succeed("mkfs.ext4 /dev/mapper/cryptroot") + machine.succeed("echo -n supersecret | cryptsetup luksFormat -q --iter-time=1 /dev/vdc -") machine.succeed("echo -n supersecret | cryptsetup luksOpen -q /dev/vdc cryptroot2") machine.succeed("mkfs.ext4 /dev/mapper/cryptroot2") diff --git a/nixos/tests/systemd-initrd-luks-tpm2.nix b/nixos/tests/systemd-initrd-luks-tpm2.nix index 6cc42bbbda73..931959f05464 100644 --- a/nixos/tests/systemd-initrd-luks-tpm2.nix +++ b/nixos/tests/systemd-initrd-luks-tpm2.nix @@ -32,7 +32,6 @@ }; }; virtualisation.rootDevice = "/dev/mapper/cryptroot"; - virtualisation.fileSystems."/".autoFormat = true; }; }; @@ -40,6 +39,8 @@ # Create encrypted volume machine.wait_for_unit("multi-user.target") machine.succeed("echo -n supersecret | cryptsetup luksFormat -q --iter-time=1 /dev/vdb -") + machine.succeed("echo -n supersecret | cryptsetup luksOpen -q /dev/vdb cryptroot") + machine.succeed("mkfs.ext4 /dev/mapper/cryptroot") machine.succeed("PASSWORD=supersecret SYSTEMD_LOG_LEVEL=debug systemd-cryptenroll --tpm2-pcrs= --tpm2-device=auto /dev/vdb |& systemd-cat") # Boot from the encrypted disk diff --git a/nixos/tests/systemd-initrd-luks-unl0kr.nix b/nixos/tests/systemd-initrd-luks-unl0kr.nix index 875e1beb7187..f9dbce1ccdd8 100644 --- a/nixos/tests/systemd-initrd-luks-unl0kr.nix +++ b/nixos/tests/systemd-initrd-luks-unl0kr.nix @@ -79,9 +79,12 @@ in }; testScript = '' - # Create encrypted volume machine.wait_for_unit("multi-user.target") + machine.succeed("echo -n ${passphrase} | cryptsetup luksFormat -q --iter-time=1 /dev/vdb -") + machine.succeed("echo -n ${passphrase} | cryptsetup luksOpen -q /dev/vdb cryptroot") + machine.succeed("mkfs.ext4 /dev/mapper/cryptroot") + machine.succeed("echo -n ${passphrase} | cryptsetup luksFormat -q --iter-time=1 /dev/vdc -") machine.succeed("echo -n ${passphrase} | cryptsetup luksOpen -q /dev/vdc cryptroot2") machine.succeed("mkfs.ext4 /dev/mapper/cryptroot2") From b9f2fa1c7dc9ae378c5bff43f45fc5c3fd149ae9 Mon Sep 17 00:00:00 2001 From: nikstur Date: Tue, 3 Feb 2026 00:49:58 +0100 Subject: [PATCH 2/3] nixos/nixos-containers: create load bearing /usr/bin /usr/bin is load bearing and needs to be inside a root before nspawn will pivot to it. This will allow us to drop systemd/0003-Fix-NixOS-containers.patch --- nixos/modules/virtualisation/nixos-containers.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/nixos/modules/virtualisation/nixos-containers.nix b/nixos/modules/virtualisation/nixos-containers.nix index 9f67f937c2f1..ad0121a48498 100644 --- a/nixos/modules/virtualisation/nixos-containers.nix +++ b/nixos/modules/virtualisation/nixos-containers.nix @@ -92,6 +92,7 @@ let # Declare root explicitly to avoid shellcheck warnings, it comes from the env declare root + mkdir -p "$root/usr/bin" mkdir -p "$root/etc" "$root/var/lib" chmod 0755 "$root/etc" "$root/var/lib" mkdir -p "$root/var/lib/private" "$root/root" /run/nixos-containers From 4aae99b7d791c4db7a7db534cba10714054c5fdc Mon Sep 17 00:00:00 2001 From: nikstur Date: Thu, 5 Feb 2026 01:45:10 +0100 Subject: [PATCH 3/3] nixos-init: init env-generator The env generator allows us to declaratively set environment variables via the module system for all systemd generators. This will allow us to drop systemd/0013-inherit-systemd-environment-when-calling-generators.patch --- .../modules/services/networking/ssh/sshd.nix | 2 + nixos/modules/system/boot/systemd.nix | 49 ++++++++++++++--- nixos/tests/systemd-ssh-proxy.nix | 5 ++ pkgs/by-name/ni/nixos-init/package.nix | 1 + .../ni/nixos-init/src/env_generator.rs | 53 +++++++++++++++++++ pkgs/by-name/ni/nixos-init/src/lib.rs | 2 + pkgs/by-name/ni/nixos-init/src/main.rs | 3 +- 7 files changed, 108 insertions(+), 7 deletions(-) create mode 100644 pkgs/by-name/ni/nixos-init/src/env_generator.rs diff --git a/nixos/modules/services/networking/ssh/sshd.nix b/nixos/modules/services/networking/ssh/sshd.nix index c289d1961205..b87e5ccad65f 100644 --- a/nixos/modules/services/networking/ssh/sshd.nix +++ b/nixos/modules/services/networking/ssh/sshd.nix @@ -742,6 +742,8 @@ in }; systemd = { + generatorPath = [ cfg.package ]; + sockets.sshd = lib.mkIf cfg.startWhenNeeded { description = "SSH Socket"; wantedBy = [ "sockets.target" ]; diff --git a/nixos/modules/system/boot/systemd.nix b/nixos/modules/system/boot/systemd.nix index 2d81b1bb3d44..9a187e86d76b 100644 --- a/nixos/modules/system/boot/systemd.nix +++ b/nixos/modules/system/boot/systemd.nix @@ -233,6 +233,8 @@ let proxy_env = config.networking.proxy.envVars; + json = pkgs.formats.json { }; + in { @@ -356,6 +358,30 @@ in ''; }; + generatorEnvironment = mkOption { + type = types.attrsOf types.str; + default = { }; + example = { + MY_VAR = "my-value"; + }; + description = '' + Environment variables for systemd generators. + + The `PATH` environment variable is populated via `systemd.generatorPath`. + ''; + }; + + generatorPath = mkOption { + type = types.listOf types.package; + default = [ ]; + example = [ + pkgs.hello + ]; + description = '' + Packages added to the `PATH` environment variable of all systemd generators. + ''; + }; + shutdown = mkOption { type = types.attrsOf types.path; default = { }; @@ -636,6 +662,12 @@ in "systemd/user-preset/00-nixos.preset".text = '' ignore * ''; + + "systemd/generator-environment.json".source = + json.generate "systemd-generator-environment.json" cfg.generatorEnvironment; + + "systemd/system-environment-generators/env-generator".source = + "${config.system.nixos-init.package}/bin/env-generator"; }; services.dbus.enable = true; @@ -683,12 +715,7 @@ in systemd.managerEnvironment = { # Doesn't contain systemd itself - everything works so it seems to use the compiled-in value for its tools # util-linux is needed for the main fsck utility wrapping the fs-specific ones - PATH = lib.makeBinPath ( - config.system.fsPackages - ++ [ cfg.package.util-linux ] - # systemd-ssh-generator needs sshd in PATH - ++ lib.optional config.services.openssh.enable config.services.openssh.package - ); + PATH = lib.makeBinPath (config.system.fsPackages ++ [ cfg.package.util-linux ]); LOCALE_ARCHIVE = "/run/current-system/sw/lib/locale/locale-archive"; TZDIR = "/etc/zoneinfo"; # If SYSTEMD_UNIT_PATH ends with an empty component (":"), the usual unit load path will be appended to the contents of the variable @@ -704,6 +731,16 @@ in DefaultIPAccounting = lib.mkDefault true; }; + # These are needed for systemd-fstab-generator to schedule systemd-fsck@ + # units. + systemd.generatorPath = config.system.fsPackages ++ [ + cfg.package.util-linux + ]; + + systemd.generatorEnvironment = { + PATH = lib.makeBinPath cfg.generatorPath; + }; + system.requiredKernelConfig = map config.lib.kernelConfig.isEnabled [ "DEVTMPFS" "CGROUPS" diff --git a/nixos/tests/systemd-ssh-proxy.nix b/nixos/tests/systemd-ssh-proxy.nix index 6ccdc0012b4f..38ae79ba9c1c 100644 --- a/nixos/tests/systemd-ssh-proxy.nix +++ b/nixos/tests/systemd-ssh-proxy.nix @@ -19,6 +19,7 @@ in nodes = { virthost = { + environment.systemPackages = [ pkgs.jq ]; services.openssh = { enable = true; settings.PermitRootLogin = "prohibit-password"; @@ -48,6 +49,10 @@ in virthost.succeed("cp '${snakeOilEd25519PrivateKey}' ~/.ssh/id_ed25519") virthost.succeed("chmod 600 ~/.ssh/id_ed25519") + with subtest("Check the environment generator"): + print(virthost.succeed("jq '.' /etc/systemd/generator-environment.json")) + print(virthost.succeed("/etc/systemd/system-environment-generators/env-generator")) + with subtest("ssh into a container with AF_UNIX"): virthost.wait_for_unit("container@guest.service") virthost.wait_until_succeeds("ssh -i ~/.ssh/id_ed25519 unix/run/systemd/nspawn/unix-export/guest/ssh echo meow | grep meow") diff --git a/pkgs/by-name/ni/nixos-init/package.nix b/pkgs/by-name/ni/nixos-init/package.nix index 0e4c26cb2dd3..c84c711c7599 100644 --- a/pkgs/by-name/ni/nixos-init/package.nix +++ b/pkgs/by-name/ni/nixos-init/package.nix @@ -48,6 +48,7 @@ rustPlatform.buildRustPackage (finalAttrs: { "initrd-init" "find-etc" "resolve-in-root" + "env-generator" ]; postInstall = '' diff --git a/pkgs/by-name/ni/nixos-init/src/env_generator.rs b/pkgs/by-name/ni/nixos-init/src/env_generator.rs new file mode 100644 index 000000000000..69995b601e59 --- /dev/null +++ b/pkgs/by-name/ni/nixos-init/src/env_generator.rs @@ -0,0 +1,53 @@ +use std::{ + collections::HashMap, + fs, + io::{self, Write}, +}; + +use anyhow::{Context, Result}; +use serde::Deserialize; + +const CONFIG_PATH: &str = "/etc/systemd/generator-environment.json"; +const KMSG_PATH: &str = "/dev/kmsg"; + +#[derive(Deserialize)] +struct Config(HashMap); + +/// Implementation for the entrypoint of the `env-generator` binary. +/// +/// Reads the JSON config for the systemd generator environment and prints it in KEY=VALUE format +/// to stdout. This makes the configured environment variables available for all systemd +/// generators. +fn env_generator_impl() -> Result<()> { + let content = fs::read(CONFIG_PATH).with_context(|| format!("Failed to read {CONFIG_PATH}"))?; + let config: Config = serde_json::from_slice(&content).context("Failed to parse config")?; + + let mut buffer = Vec::new(); + for (key, value) in config.0 { + writeln!(&mut buffer, "{key}=\"{value}\"").context("Failed to write to buffer")?; + } + + let stdout = io::stdout(); + let mut locked = stdout.lock(); + locked + .write_all(&buffer) + .context("Failed to write to stdout")?; + + Ok(()) +} + +/// Entrypoint for the `env-generator` binary. +/// +/// Generators cannot use normal logging but have to write to /dev/kmsg. +/// +/// The return value is just here so that we can use the `main.rs` entrypoint for this binary. +/// Errors returned from this function will not be logged and thus are meaningless. +pub fn env_generator() -> Result<()> { + if let Err(err) = env_generator_impl() { + // Sometimes we do not have /dev/kmsg, e.g. inside a container + if let Ok(mut kmsg) = fs::OpenOptions::new().write(true).open(KMSG_PATH) { + let _ = write!(kmsg, "<3>env-generator: {err:#}"); + } + } + Ok(()) +} diff --git a/pkgs/by-name/ni/nixos-init/src/lib.rs b/pkgs/by-name/ni/nixos-init/src/lib.rs index 2ee90c6f8228..e9a716724051 100644 --- a/pkgs/by-name/ni/nixos-init/src/lib.rs +++ b/pkgs/by-name/ni/nixos-init/src/lib.rs @@ -1,5 +1,6 @@ mod activate; mod config; +mod env_generator; mod find_etc; mod fs; mod init; @@ -14,6 +15,7 @@ use anyhow::{Context, Result, bail}; pub use crate::{ activate::activate, + env_generator::env_generator, find_etc::find_etc, init::init, initrd_init::initrd_init, diff --git a/pkgs/by-name/ni/nixos-init/src/main.rs b/pkgs/by-name/ni/nixos-init/src/main.rs index a051af590be3..4f74415b8d36 100644 --- a/pkgs/by-name/ni/nixos-init/src/main.rs +++ b/pkgs/by-name/ni/nixos-init/src/main.rs @@ -2,7 +2,7 @@ use std::{env, io::Write, process::ExitCode}; use log::Level; -use nixos_init::{find_etc, initrd_init, resolve_in_root}; +use nixos_init::{env_generator, find_etc, initrd_init, resolve_in_root}; fn main() -> ExitCode { let arg0 = env::args() @@ -15,6 +15,7 @@ fn main() -> ExitCode { "find-etc" => find_etc, "resolve-in-root" => resolve_in_root, "initrd-init" => initrd_init, + "env-generator" => env_generator, _ => { log::error!("Command {arg0} unknown"); return ExitCode::FAILURE;