switch-to-configuration-ng: Better handling of socket-activated units

Previously, if any unit had a socket associated with it, stc-ng
counted it as "socket-activated", meaning that the unit would get
stopped and the socket get restarted. That can wreak havoc on units
like systemd-udevd and systemd-networkd.

Instead, let units set the new flag notSocketActivated, which sets a
boolean on the unit indicating to stc-ng that the unit wants to be
treated like any other non-socket-activated unit instead. That will
stop/start or restart these units on upgrades, without unnecessarily
tearing down any machinery that the system needs to run.

nixos/lib/systemd-lib.nix

@@ -579,6 +579,8 @@ in rec {
       '' else "")
        + optionalString (def ? stopIfChanged && !def.stopIfChanged) ''
          X-StopIfChanged=false
+       '' + optionalString (def ? notSocketActivated && def.notSocketActivated) ''
+         X-NotSocketActivated=true
       '' + attrsToSection def.serviceConfig);
     };
 

nixos/lib/systemd-unit-options.nix

@@ -535,6 +535,18 @@ in rec {
         '';
       };
 
+      notSocketActivated = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          If set, a changed unit is never assumed to be
+          socket-activated on configuration activation, even if
+          it might have associated socket units. Instead, the unit
+          will be restarted (or stopped/started) as if it had no
+          associated sockets.
+        '';
+      };
+
       startAt = mkOption {
         type = with types; either str (listOf str);
         default = [];

nixos/modules/services/hardware/udev.nix

@@ -433,8 +433,9 @@ in
       fi
     '';
 
-    systemd.services.systemd-udevd =
+    systemd.services.systemd-udevd = {
-      { restartTriggers = [ config.environment.etc."udev/rules.d".source ];
+        restartTriggers = [ config.environment.etc."udev/rules.d".source ];
+        notSocketActivated = true;
       };
 
   };

nixos/modules/system/boot/networkd.nix

@@ -2883,6 +2883,7 @@ let
           config.environment.etc."systemd/networkd.conf".source
         ];
         aliases = [ "dbus-org.freedesktop.network1.service" ];
+        notSocketActivated = true;
       };
 
       networking.iproute2 = mkIf (cfg.config.addRouteTablesToIPRoute2 && cfg.config.routeTables != { }) {

pkgs/by-name/sw/switch-to-configuration-ng/src/src/main.rs

@@ -68,6 +68,8 @@ const RELOAD_LIST_FILE: &str = "/run/nixos/reload-list";
 // `stopIfChanged = true` is ignored, switch-to-configuration will handle `restartIfChanged =
 // false` and `reloadIfChanged = true`. This is the same as specifying a restart trigger in the
 // NixOS module.
+// In addition, switch-to-configuration will handle notSocketActivated=true to disable treatment
+// of units as "socket-activated" even though they might have any associated sockets.
 //
 // The reload file asks this program to reload a unit. This is the same as specifying a reload
 // trigger in the NixOS module and can be ignored if the unit is restarted in this activation.
@@ -583,6 +585,8 @@ fn handle_modified_unit(
             } else {
                 // If this unit is socket-activated, then stop the socket unit(s) as well, and
                 // restart the socket(s) instead of the service.
+                // We count as "socket-activated" any unit that doesn't declare itself not so
+                // via X-NotSocketActivated, that has any associated .socket units.
                 let mut socket_activated = false;
                 if unit.ends_with(".service") {
                     let mut sockets = if let Some(Some(Some(sockets))) = new_unit_info.map(|info| {
@@ -634,6 +638,12 @@ fn handle_modified_unit(
                         }
                     }
                 }
+                if parse_systemd_bool(new_unit_info, "Service", "X-NotSocketActivated", false) {
+                    // If the unit explicitly opts out of socket
+                    // activation, restart it as if it weren't (but do
+                    // restart its sockets, that's fine):
+                    socket_activated = false;
+                }
 
                 // If the unit is not socket-activated, record that this unit needs to be started
                 // below. We write this to a file to ensure that the service gets restarted if