From a0165bd5afa5f7c2c045fcc6988810cc85e1d8f1 Mon Sep 17 00:00:00 2001
From: Will Fancher <elvishjerricco@gmail.com>
Date: Thu, 19 Sep 2024 04:17:31 -0400
Subject: [PATCH] nixos/systemd/tpm2: Enable tpm2-setup and tpm2.target

tpm2.target was functionally useless without these services and this
generator. When systemd-cryptsetup-generator creates
systemd-cryptsetup@.service units, they are ordered after
systemd-tpm2-setup-early.service, not tpm2.target. These services are
themselves ordered after tpm2.target.

Note: The systemd-tpm2-setup(-early) services will serve no *function*
under a normal NixOS system at the moment. Because of their
ConditionSecurity=measured-uki, they will always be skipped, unless
you are building an appliance with the system.build.uki feature. Thus,
these are enabled solely for their systemd unit ordering properties.
---
 nixos/modules/system/boot/systemd/tpm2.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/nixos/modules/system/boot/systemd/tpm2.nix b/nixos/modules/system/boot/systemd/tpm2.nix
index 31c63f75816e..0870e35212f5 100644
--- a/nixos/modules/system/boot/systemd/tpm2.nix
+++ b/nixos/modules/system/boot/systemd/tpm2.nix
@@ -47,6 +47,8 @@
       lib.mkIf cfg.tpm2.enable {
         systemd.additionalUpstreamSystemUnits = [
           "tpm2.target"
+          "systemd-tpm2-setup-early.service"
+          "systemd-tpm2-setup.service"
         ];
       }
     )
@@ -59,6 +61,7 @@
       lib.mkIf cfg.tpm2.enable {
         boot.initrd.systemd.additionalUpstreamUnits = [
           "tpm2.target"
+          "systemd-tpm2-setup-early.service"
         ];
 
         boot.initrd.availableKernelModules =
@@ -68,6 +71,8 @@
           ) "tpm-crb";
         boot.initrd.systemd.storePaths = [
           pkgs.tpm2-tss
+          "${cfg.package}/lib/systemd/systemd-tpm2-setup"
+          "${cfg.package}/lib/systemd/system-generators/systemd-tpm2-generator"
         ];
       }
     )