From 4346b3bf8498de5a5105b81ff926aa4fb618559b Mon Sep 17 00:00:00 2001 From: nikstur Date: Sun, 8 Feb 2026 16:26:05 +0100 Subject: [PATCH 01/14] systemd: add patch policy --- pkgs/os-specific/linux/systemd/default.nix | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix index 0b221cac145a..1fda3dbd6d85 100644 --- a/pkgs/os-specific/linux/systemd/default.nix +++ b/pkgs/os-specific/linux/systemd/default.nix @@ -215,6 +215,19 @@ stdenv.mkDerivation (finalAttrs: { hash = "sha256-FUKj3lvjz8TIsyu8NyJYtiNele+1BhdJPdw7r7nW6as="; }; + # PATCH POLICY + # + # There are only two reasons we accept patches on systemd: + # 1. systemd functionality is fundamentally incompatible with how NixOS works + # and workarounds are not possible. + # 2. Hotfixes that we want to apply before they have reached a systemd branch + # we can use. If we come up with the fixes in Nixpkgs, they need to be + # reported upstream and the upstream issue needs to be linked in the + # commit message of the patch. + # + # Importantly, patches to improve usability, enable new features on NixOS or + # add entirely new features to systemd are not allowed. + # On major changes, or when otherwise required, you *must* : # 1. reformat the patches, # 2. `git am path/to/00*.patch` them into a systemd worktree, From b5611f96b6e1be1bf94165b3acd3bf49970a4c56 Mon Sep 17 00:00:00 2001 From: nikstur Date: Mon, 16 Feb 2026 23:28:07 +0100 Subject: [PATCH 02/14] systemd: drop 0001-Start-device-units-for-uninitialised-encrypted-devic.patch This is possibile because of the preparations from b13891782fdec1b72e1e9ab4f86fce1638f20203 --- ...ts-for-uninitialised-encrypted-devic.patch | 29 ------------------- pkgs/os-specific/linux/systemd/default.nix | 1 - 2 files changed, 30 deletions(-) delete mode 100644 pkgs/os-specific/linux/systemd/0001-Start-device-units-for-uninitialised-encrypted-devic.patch diff --git a/pkgs/os-specific/linux/systemd/0001-Start-device-units-for-uninitialised-encrypted-devic.patch b/pkgs/os-specific/linux/systemd/0001-Start-device-units-for-uninitialised-encrypted-devic.patch deleted file mode 100644 index 02845eb126f6..000000000000 --- a/pkgs/os-specific/linux/systemd/0001-Start-device-units-for-uninitialised-encrypted-devic.patch +++ /dev/null @@ -1,29 +0,0 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 -From: Eelco Dolstra -Date: Tue, 8 Jan 2013 15:46:30 +0100 -Subject: [PATCH] Start device units for uninitialised encrypted devices - -This is necessary because the NixOS service that initialises the -filesystem depends on the appearance of the device unit. Also, this -makes more sense to me: the device is ready; it's the filesystem -that's not, but taking care of that is the responsibility of the mount -unit. (However, this ignores the fsck unit, so it's not perfect...) ---- - rules.d/99-systemd.rules.in | 4 ---- - 1 file changed, 4 deletions(-) - -diff --git a/rules.d/99-systemd.rules.in b/rules.d/99-systemd.rules.in -index bebc4d7d09..60278a0da7 100644 ---- a/rules.d/99-systemd.rules.in -+++ b/rules.d/99-systemd.rules.in -@@ -30,10 +30,6 @@ SUBSYSTEM=="block", ACTION=="add", KERNEL=="dm-*", ENV{DM_NAME}!="?*", ENV{SYSTE - # Import previous SYSTEMD_READY state. - SUBSYSTEM=="block", ENV{DM_UDEV_DISABLE_OTHER_RULES_FLAG}=="1", ENV{SYSTEMD_READY}=="", IMPORT{db}="SYSTEMD_READY" - --# Ignore encrypted devices with no identified superblock on it, since --# we are probably still calling mke2fs or mkswap on it. --SUBSYSTEM=="block", ENV{DM_UUID}=="CRYPT-*", ENV{ID_PART_TABLE_TYPE}=="", ENV{ID_FS_USAGE}=="", ENV{SYSTEMD_READY}="0" -- - # Ignore raid devices that are not yet assembled and started - SUBSYSTEM=="block", ENV{DEVTYPE}=="disk", KERNEL=="md*", TEST!="md/array_state", ENV{SYSTEMD_READY}="0" - SUBSYSTEM=="block", ENV{DEVTYPE}=="disk", KERNEL=="md*", ATTR{md/array_state}=="|clear|inactive", ENV{SYSTEMD_READY}="0" diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix index 1fda3dbd6d85..f48d9f846b37 100644 --- a/pkgs/os-specific/linux/systemd/default.nix +++ b/pkgs/os-specific/linux/systemd/default.nix @@ -237,7 +237,6 @@ stdenv.mkDerivation (finalAttrs: { # Use `find . -name "*.patch" | sort` to get an up-to-date listing of all # patches patches = [ - ./0001-Start-device-units-for-uninitialised-encrypted-devic.patch ./0002-Don-t-try-to-unmount-nix-or-nix-store.patch ./0003-Fix-NixOS-containers.patch ./0004-Add-some-NixOS-specific-unit-directories.patch From 207fe325e9b0ac42c44009e5d600ea227ce26ada Mon Sep 17 00:00:00 2001 From: nikstur Date: Mon, 16 Feb 2026 23:28:54 +0100 Subject: [PATCH 03/14] systemd: drop 0003-Fix-NixOS-containers.patch This is possibile because of the preparations from b9f2fa1c7dc9ae378c5bff43f45fc5c3fd149ae9 --- .../systemd/0003-Fix-NixOS-containers.patch | 31 ------------------- pkgs/os-specific/linux/systemd/default.nix | 1 - 2 files changed, 32 deletions(-) delete mode 100644 pkgs/os-specific/linux/systemd/0003-Fix-NixOS-containers.patch diff --git a/pkgs/os-specific/linux/systemd/0003-Fix-NixOS-containers.patch b/pkgs/os-specific/linux/systemd/0003-Fix-NixOS-containers.patch deleted file mode 100644 index fc80edc766cf..000000000000 --- a/pkgs/os-specific/linux/systemd/0003-Fix-NixOS-containers.patch +++ /dev/null @@ -1,31 +0,0 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 -From: Eelco Dolstra -Date: Wed, 16 Apr 2014 10:59:28 +0200 -Subject: [PATCH] Fix NixOS containers - -In NixOS containers, the init script is bind-mounted into the -container, so checking early whether it exists will fail. ---- - src/nspawn/nspawn.c | 2 ++ - 1 file changed, 2 insertions(+) - -diff --git a/src/nspawn/nspawn.c b/src/nspawn/nspawn.c -index 84e94e845a..a0052c1c88 100644 ---- a/src/nspawn/nspawn.c -+++ b/src/nspawn/nspawn.c -@@ -6368,6 +6368,7 @@ static int run(int argc, char *argv[]) { - goto finish; - } - } else { -+#if 0 - _cleanup_free_ char *p = NULL; - - if (arg_pivot_root_new) -@@ -6387,6 +6388,7 @@ static int run(int argc, char *argv[]) { - log_error_errno(r, "Unable to determine if %s looks like it has an OS tree (i.e. whether /usr/ exists): %m", arg_directory); - goto finish; - } -+#endif - } - - if (userns_fd >= 0) { diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix index f48d9f846b37..45fcef30c76f 100644 --- a/pkgs/os-specific/linux/systemd/default.nix +++ b/pkgs/os-specific/linux/systemd/default.nix @@ -238,7 +238,6 @@ stdenv.mkDerivation (finalAttrs: { # patches patches = [ ./0002-Don-t-try-to-unmount-nix-or-nix-store.patch - ./0003-Fix-NixOS-containers.patch ./0004-Add-some-NixOS-specific-unit-directories.patch ./0005-Get-rid-of-a-useless-message-in-user-sessions.patch ./0006-hostnamed-localed-timedated-disable-methods-that-cha.patch From a9bf6722aea43a911da94d80013b0df24ea12161 Mon Sep 17 00:00:00 2001 From: nikstur Date: Sun, 8 Feb 2026 16:34:44 +0100 Subject: [PATCH 04/14] systemd: drop 0004-Add-some-NixOS-specific-unit-directories.patch This patch adds new functionality to systemd, which as per the new patch policy is not allowed. The main use-case this supports (imperatively installing systemd services) is not used as far as I can tell and is not something we want to support. Most services do not run anyways without further adjustments on NixOS. --- ...some-NixOS-specific-unit-directories.patch | 129 ------------------ pkgs/os-specific/linux/systemd/default.nix | 1 - 2 files changed, 130 deletions(-) delete mode 100644 pkgs/os-specific/linux/systemd/0004-Add-some-NixOS-specific-unit-directories.patch diff --git a/pkgs/os-specific/linux/systemd/0004-Add-some-NixOS-specific-unit-directories.patch b/pkgs/os-specific/linux/systemd/0004-Add-some-NixOS-specific-unit-directories.patch deleted file mode 100644 index 6ba6bcffd76c..000000000000 --- a/pkgs/os-specific/linux/systemd/0004-Add-some-NixOS-specific-unit-directories.patch +++ /dev/null @@ -1,129 +0,0 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 -From: Raito Bezarius -Date: Mon, 19 Jun 2023 02:13:42 +0200 -Subject: [PATCH] Add some NixOS-specific unit directories - -Look in `/nix/var/nix/profiles/default/lib/systemd/{system,user}` for -units provided by packages installed into the default profile via -`nix-env -iA nixos.$package`. - -Also, remove /usr and /lib as these don't exist on NixOS. - -Original-Author: Eelco Dolstra ---- - src/core/systemd.pc.in | 8 ++++---- - src/libsystemd/sd-path/path-lookup.c | 20 +++----------------- - 2 files changed, 7 insertions(+), 21 deletions(-) - -diff --git a/src/core/systemd.pc.in b/src/core/systemd.pc.in -index 862d57dcb6..8ba0ca4486 100644 ---- a/src/core/systemd.pc.in -+++ b/src/core/systemd.pc.in -@@ -46,10 +46,10 @@ systemdsystemconfdir=${systemd_system_conf_dir} - systemd_user_conf_dir=${sysconfdir}/systemd/user - systemduserconfdir=${systemd_user_conf_dir} - --systemd_system_unit_path=${systemd_system_conf_dir}:/etc/systemd/system:/run/systemd/system:/usr/local/lib/systemd/system:${systemd_system_unit_dir}:/usr/lib/systemd/system:/lib/systemd/system -+systemd_system_unit_path=${systemd_system_conf_dir}:/etc/systemd/system:/nix/var/nix/profiles/default/lib/systemd/system:/run/systemd/system:${systemd_system_unit_dir} - systemdsystemunitpath=${systemd_system_unit_path} - --systemd_user_unit_path=${systemd_user_conf_dir}:/etc/systemd/user:/run/systemd/user:/usr/local/lib/systemd/user:/usr/local/share/systemd/user:${systemd_user_unit_dir}:/usr/lib/systemd/user:/usr/share/systemd/user -+systemd_user_unit_path=${systemd_user_conf_dir}:/etc/systemd/user:/nix/var/nix/profiles/default/lib/systemd/user:/run/systemd/user:${systemd_user_unit_dir} - systemduserunitpath=${systemd_user_unit_path} - - systemd_system_generator_dir=${prefix}/lib/systemd/system-generators -@@ -58,10 +58,10 @@ systemdsystemgeneratordir=${systemd_system_generator_dir} - systemd_user_generator_dir=${prefix}/lib/systemd/user-generators - systemdusergeneratordir=${systemd_user_generator_dir} - --systemd_system_generator_path=/run/systemd/system-generators:/etc/systemd/system-generators:/usr/local/lib/systemd/system-generators:${systemd_system_generator_dir} -+systemd_system_generator_path=/run/systemd/system-generators:/etc/systemd/system-generators:${systemd_system_generator_dir} - systemdsystemgeneratorpath=${systemd_system_generator_path} - --systemd_user_generator_path=/run/systemd/user-generators:/etc/systemd/user-generators:/usr/local/lib/systemd/user-generators:${systemd_user_generator_dir} -+systemd_user_generator_path=/run/systemd/user-generators:/etc/systemd/user-generators:${systemd_user_generator_dir} - systemdusergeneratorpath=${systemd_user_generator_path} - - systemd_sleep_dir=${prefix}/lib/systemd/system-sleep -diff --git a/src/libsystemd/sd-path/path-lookup.c b/src/libsystemd/sd-path/path-lookup.c -index 32c14fb14a..7f0bf62844 100644 ---- a/src/libsystemd/sd-path/path-lookup.c -+++ b/src/libsystemd/sd-path/path-lookup.c -@@ -102,11 +102,7 @@ int runtime_directory(RuntimeScope scope, const char *fallback_suffix, char **re - } - - static const char* const user_data_unit_paths[] = { -- "/usr/local/lib/systemd/user", -- "/usr/local/share/systemd/user", - USER_DATA_UNIT_DIR, -- "/usr/lib/systemd/user", -- "/usr/share/systemd/user", - NULL - }; - -@@ -519,16 +515,13 @@ int lookup_paths_init( - persistent_config, - SYSTEM_CONFIG_UNIT_DIR, - "/etc/systemd/system", -+ "/nix/var/nix/profiles/default/lib/systemd/system", - ASSERT_PTR(persistent_attached), - ASSERT_PTR(runtime_config), - "/run/systemd/system", - ASSERT_PTR(runtime_attached), - STRV_IFNOTNULL(generator), -- "/usr/local/lib/systemd/system", - SYSTEM_DATA_UNIT_DIR, -- "/usr/lib/systemd/system", -- /* To be used ONLY for images which might be legacy split-usr */ -- FLAGS_SET(flags, LOOKUP_PATHS_SPLIT_USR) ? "/lib/systemd/system" : STRV_IGNORE, - STRV_IFNOTNULL(generator_late)); - break; - -@@ -546,13 +539,10 @@ int lookup_paths_init( - add = strv_new(persistent_config, - USER_CONFIG_UNIT_DIR, - "/etc/systemd/user", -+ "/nix/var/nix/profiles/default/lib/systemd/user", - ASSERT_PTR(runtime_config), - "/run/systemd/user", -- "/usr/local/share/systemd/user", -- "/usr/share/systemd/user", -- "/usr/local/lib/systemd/user", -- USER_DATA_UNIT_DIR, -- "/usr/lib/systemd/user"); -+ USER_DATA_UNIT_DIR); - break; - - case RUNTIME_SCOPE_USER: -@@ -692,7 +682,6 @@ void lookup_paths_log(LookupPaths *lp) { - static const char* const system_generator_paths[] = { - "/run/systemd/system-generators", - "/etc/systemd/system-generators", -- "/usr/local/lib/systemd/system-generators", - SYSTEM_GENERATOR_DIR, - NULL, - }; -@@ -700,7 +689,6 @@ static const char* const system_generator_paths[] = { - static const char* const user_generator_paths[] = { - "/run/systemd/user-generators", - "/etc/systemd/user-generators", -- "/usr/local/lib/systemd/user-generators", - USER_GENERATOR_DIR, - NULL, - }; -@@ -708,7 +696,6 @@ static const char* const user_generator_paths[] = { - static const char* const system_env_generator_paths[] = { - "/run/systemd/system-environment-generators", - "/etc/systemd/system-environment-generators", -- "/usr/local/lib/systemd/system-environment-generators", - SYSTEM_ENV_GENERATOR_DIR, - NULL, - }; -@@ -716,7 +703,6 @@ static const char* const system_env_generator_paths[] = { - static const char* const user_env_generator_paths[] = { - "/run/systemd/user-environment-generators", - "/etc/systemd/user-environment-generators", -- "/usr/local/lib/systemd/user-environment-generators", - USER_ENV_GENERATOR_DIR, - NULL, - }; diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix index 45fcef30c76f..8431718c7b29 100644 --- a/pkgs/os-specific/linux/systemd/default.nix +++ b/pkgs/os-specific/linux/systemd/default.nix @@ -238,7 +238,6 @@ stdenv.mkDerivation (finalAttrs: { # patches patches = [ ./0002-Don-t-try-to-unmount-nix-or-nix-store.patch - ./0004-Add-some-NixOS-specific-unit-directories.patch ./0005-Get-rid-of-a-useless-message-in-user-sessions.patch ./0006-hostnamed-localed-timedated-disable-methods-that-cha.patch ./0007-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch From d02b5e8de41752d2dec4f7b5bfb6bf994de7c8ea Mon Sep 17 00:00:00 2001 From: nikstur Date: Sun, 8 Feb 2026 16:31:08 +0100 Subject: [PATCH 05/14] systemd: drop 0005-Get-rid-of-a-useless-message-in-user-sessions.patch This is entirely a "usability" patch which as per the new patch policy is not allowed. It's value even in the best of times is quite questionable and it's unclear whether it has done anything in recent years. --- ...f-a-useless-message-in-user-sessions.patch | 28 ------------------- pkgs/os-specific/linux/systemd/default.nix | 1 - 2 files changed, 29 deletions(-) delete mode 100644 pkgs/os-specific/linux/systemd/0005-Get-rid-of-a-useless-message-in-user-sessions.patch diff --git a/pkgs/os-specific/linux/systemd/0005-Get-rid-of-a-useless-message-in-user-sessions.patch b/pkgs/os-specific/linux/systemd/0005-Get-rid-of-a-useless-message-in-user-sessions.patch deleted file mode 100644 index 112f3f509f54..000000000000 --- a/pkgs/os-specific/linux/systemd/0005-Get-rid-of-a-useless-message-in-user-sessions.patch +++ /dev/null @@ -1,28 +0,0 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 -From: Eelco Dolstra -Date: Mon, 11 May 2015 15:39:38 +0200 -Subject: [PATCH] Get rid of a useless message in user sessions - -Namely lots of variants of - - Unit nix-var-nix-db.mount is bound to inactive unit dev-disk-by\x2dlabel-nixos.device. Stopping, too. - -in containers. ---- - src/core/manager.c | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - -diff --git a/src/core/manager.c b/src/core/manager.c -index 79fa19d976..2115d74595 100644 ---- a/src/core/manager.c -+++ b/src/core/manager.c -@@ -1579,7 +1579,8 @@ static unsigned manager_dispatch_stop_when_bound_queue(Manager *m) { - if (!unit_is_bound_by_inactive(u, &culprit)) - continue; - -- log_unit_debug(u, "Unit is stopped because bound to inactive unit %s.", culprit->id); -+ if (u->type != UNIT_MOUNT || detect_container() <= 0) -+ log_unit_debug(u, "Unit is stopped because bound to inactive unit %s.", culprit->id); - - /* If stopping a unit fails continuously we might enter a stop loop here, hence stop acting on the - * service being unnecessary after a while. */ diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix index 8431718c7b29..64f815317842 100644 --- a/pkgs/os-specific/linux/systemd/default.nix +++ b/pkgs/os-specific/linux/systemd/default.nix @@ -238,7 +238,6 @@ stdenv.mkDerivation (finalAttrs: { # patches patches = [ ./0002-Don-t-try-to-unmount-nix-or-nix-store.patch - ./0005-Get-rid-of-a-useless-message-in-user-sessions.patch ./0006-hostnamed-localed-timedated-disable-methods-that-cha.patch ./0007-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch ./0008-localectl-use-etc-X11-xkb-for-list-x11.patch From 84cc9d46366074cc3066ca5e0b53060383198af4 Mon Sep 17 00:00:00 2001 From: nikstur Date: Sun, 8 Feb 2026 16:32:52 +0100 Subject: [PATCH 06/14] systemd: drop 0006-hostnamed-localed-timedated-disable-methods-that-cha.patch This is entirely a "usability" patch which as per the new patch policy is not allowed. Additionally, this prohibits valid uses cases (dynamically changing some parts of the system even if it's configured declaratively). --- nixos/tests/systemd.nix | 1 - ...d-timedated-disable-methods-that-cha.patch | 105 ------------------ pkgs/os-specific/linux/systemd/default.nix | 1 - 3 files changed, 107 deletions(-) delete mode 100644 pkgs/os-specific/linux/systemd/0006-hostnamed-localed-timedated-disable-methods-that-cha.patch diff --git a/nixos/tests/systemd.nix b/nixos/tests/systemd.nix index 98cc88a0326f..6aa979d41d5a 100644 --- a/nixos/tests/systemd.nix +++ b/nixos/tests/systemd.nix @@ -179,7 +179,6 @@ # Regression test for https://github.com/NixOS/nixpkgs/pull/91232 with subtest("setting transient hostnames works"): machine.succeed("hostnamectl set-hostname --transient machine-transient") - machine.fail("hostnamectl set-hostname machine-all") with subtest("systemd-shutdown works"): machine.shutdown() diff --git a/pkgs/os-specific/linux/systemd/0006-hostnamed-localed-timedated-disable-methods-that-cha.patch b/pkgs/os-specific/linux/systemd/0006-hostnamed-localed-timedated-disable-methods-that-cha.patch deleted file mode 100644 index 2abe659a42bf..000000000000 --- a/pkgs/os-specific/linux/systemd/0006-hostnamed-localed-timedated-disable-methods-that-cha.patch +++ /dev/null @@ -1,105 +0,0 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 -From: Gabriel Ebner -Date: Sun, 6 Dec 2015 14:26:36 +0100 -Subject: [PATCH] hostnamed, localed, timedated: disable methods that change - system settings. - ---- - src/hostname/hostnamed.c | 6 ++++++ - src/locale/localed.c | 9 +++++++++ - src/timedate/timedated.c | 10 ++++++++++ - 3 files changed, 25 insertions(+) - -diff --git a/src/hostname/hostnamed.c b/src/hostname/hostnamed.c -index 04c72e8137..1f9f296d56 100644 ---- a/src/hostname/hostnamed.c -+++ b/src/hostname/hostnamed.c -@@ -1421,6 +1421,9 @@ static int method_set_static_hostname(sd_bus_message *m, void *userdata, sd_bus_ - if (r < 0) - return r; - -+ return sd_bus_error_setf(error, SD_BUS_ERROR_NOT_SUPPORTED, -+ "Changing system settings via systemd is not supported on NixOS."); -+ - name = empty_to_null(name); - - context_read_etc_hostname(c); -@@ -1487,6 +1490,9 @@ static int set_machine_info(Context *c, sd_bus_message *m, int prop, sd_bus_mess - if (r < 0) - return r; - -+ return sd_bus_error_setf(error, SD_BUS_ERROR_NOT_SUPPORTED, -+ "Changing system settings via systemd is not supported on NixOS."); -+ - name = empty_to_null(name); - - context_read_machine_info(c); -diff --git a/src/locale/localed.c b/src/locale/localed.c -index 041ba29cd8..02fbe3e278 100644 ---- a/src/locale/localed.c -+++ b/src/locale/localed.c -@@ -221,6 +221,9 @@ static int method_set_locale(sd_bus_message *m, void *userdata, sd_bus_error *er - - use_localegen = locale_gen_check_available(); - -+ return sd_bus_error_setf(error, SD_BUS_ERROR_NOT_SUPPORTED, -+ "Changing system settings via systemd is not supported on NixOS."); -+ - /* If single locale without variable name is provided, then we assume it is LANG=. */ - if (strv_length(l) == 1 && !strchr(l[0], '=')) { - if (!locale_is_valid(l[0])) -@@ -338,6 +341,9 @@ static int method_set_vc_keyboard(sd_bus_message *m, void *userdata, sd_bus_erro - if (r < 0) - return bus_log_parse_error(r); - -+ return sd_bus_error_setf(error, SD_BUS_ERROR_NOT_SUPPORTED, -+ "Changing system settings via systemd is not supported on NixOS."); -+ - vc_context_empty_to_null(&in); - - r = vc_context_verify_and_warn(&in, LOG_ERR, error); -@@ -455,6 +461,9 @@ static int method_set_x11_keyboard(sd_bus_message *m, void *userdata, sd_bus_err - if (r < 0) - return bus_log_parse_error(r); - -+ return sd_bus_error_setf(error, SD_BUS_ERROR_NOT_SUPPORTED, -+ "Changing system settings via systemd is not supported on NixOS."); -+ - x11_context_empty_to_null(&in); - - r = x11_context_verify_and_warn(&in, LOG_ERR, error); -diff --git a/src/timedate/timedated.c b/src/timedate/timedated.c -index 43cf3fddb9..1455830cba 100644 ---- a/src/timedate/timedated.c -+++ b/src/timedate/timedated.c -@@ -680,6 +680,10 @@ static int method_set_timezone(sd_bus_message *m, void *userdata, sd_bus_error * - if (r < 0) - return r; - -+ if (getenv("NIXOS_STATIC_TIMEZONE")) -+ return sd_bus_error_setf(error, SD_BUS_ERROR_NOT_SUPPORTED, -+ "Changing timezone via systemd is not supported when it is set in NixOS configuration."); -+ - if (!timezone_is_valid(z, LOG_DEBUG)) - return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Invalid or not installed time zone '%s'", z); - -@@ -758,6 +762,9 @@ static int method_set_local_rtc(sd_bus_message *m, void *userdata, sd_bus_error - if (r < 0) - return r; - -+ return sd_bus_error_setf(error, SD_BUS_ERROR_NOT_SUPPORTED, -+ "Changing system settings via systemd is not supported on NixOS."); -+ - if (lrtc == c->local_rtc && !fix_system) - return sd_bus_reply_method_return(m, NULL); - -@@ -956,6 +963,9 @@ static int method_set_ntp(sd_bus_message *m, void *userdata, sd_bus_error *error - if (r < 0) - return r; - -+ return sd_bus_error_setf(error, SD_BUS_ERROR_NOT_SUPPORTED, -+ "Changing system settings via systemd is not supported on NixOS."); -+ - r = context_update_ntp_status(c, bus, m); - if (r < 0) - return r; diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix index 64f815317842..87e31809c86d 100644 --- a/pkgs/os-specific/linux/systemd/default.nix +++ b/pkgs/os-specific/linux/systemd/default.nix @@ -238,7 +238,6 @@ stdenv.mkDerivation (finalAttrs: { # patches patches = [ ./0002-Don-t-try-to-unmount-nix-or-nix-store.patch - ./0006-hostnamed-localed-timedated-disable-methods-that-cha.patch ./0007-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch ./0008-localectl-use-etc-X11-xkb-for-list-x11.patch ./0009-add-rootprefix-to-lookup-dir-paths.patch From c2b2ba8274bbe50de8facbffc3cddfad532a47ba Mon Sep 17 00:00:00 2001 From: nikstur Date: Sun, 8 Feb 2026 16:49:16 +0100 Subject: [PATCH 07/14] systemd: drop 0008-localectl-use-etc-X11-xkb-for-list-x11.patch This can now configured via an environment variable. --- nixos/modules/system/boot/systemd.nix | 4 ++++ ...calectl-use-etc-X11-xkb-for-list-x11.patch | 24 ------------------- pkgs/os-specific/linux/systemd/default.nix | 1 - 3 files changed, 4 insertions(+), 25 deletions(-) delete mode 100644 pkgs/os-specific/linux/systemd/0008-localectl-use-etc-X11-xkb-for-list-x11.patch diff --git a/nixos/modules/system/boot/systemd.nix b/nixos/modules/system/boot/systemd.nix index 750a462ad868..f00888b94c44 100644 --- a/nixos/modules/system/boot/systemd.nix +++ b/nixos/modules/system/boot/systemd.nix @@ -604,6 +604,10 @@ in environment.systemPackages = [ cfg.package ]; + environment.variables = { + SYSTEMD_XKB_DIRECTORY = "/etc/X11/xkb"; + }; + environment.etc = let # generate contents for /etc/systemd/${dir} from attrset of links and packages diff --git a/pkgs/os-specific/linux/systemd/0008-localectl-use-etc-X11-xkb-for-list-x11.patch b/pkgs/os-specific/linux/systemd/0008-localectl-use-etc-X11-xkb-for-list-x11.patch deleted file mode 100644 index d2eb05c290be..000000000000 --- a/pkgs/os-specific/linux/systemd/0008-localectl-use-etc-X11-xkb-for-list-x11.patch +++ /dev/null @@ -1,24 +0,0 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 -From: Imuli -Date: Wed, 19 Oct 2016 08:46:47 -0400 -Subject: [PATCH] localectl: use /etc/X11/xkb for list-x11-* - -NixOS has an option to link the xkb data files to /etc/X11, but not to -/usr/share/X11. ---- - src/locale/localectl.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/src/locale/localectl.c b/src/locale/localectl.c -index 63703007ad..50def81940 100644 ---- a/src/locale/localectl.c -+++ b/src/locale/localectl.c -@@ -295,7 +295,7 @@ static const char* xkb_directory(void) { - static const char *cached = NULL; - - if (!cached) -- cached = secure_getenv("SYSTEMD_XKB_DIRECTORY") ?: "/usr/share/X11/xkb"; -+ cached = secure_getenv("SYSTEMD_XKB_DIRECTORY") ?: "/etc/X11/xkb"; - return cached; - } - diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix index 87e31809c86d..812d7227a48c 100644 --- a/pkgs/os-specific/linux/systemd/default.nix +++ b/pkgs/os-specific/linux/systemd/default.nix @@ -239,7 +239,6 @@ stdenv.mkDerivation (finalAttrs: { patches = [ ./0002-Don-t-try-to-unmount-nix-or-nix-store.patch ./0007-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch - ./0008-localectl-use-etc-X11-xkb-for-list-x11.patch ./0009-add-rootprefix-to-lookup-dir-paths.patch ./0010-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch ./0011-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch From cdc746ff13296f064ca6e0a09e689df3fa8dab59 Mon Sep 17 00:00:00 2001 From: nikstur Date: Sun, 8 Feb 2026 16:41:48 +0100 Subject: [PATCH 08/14] systemd: drop 0010-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch Instead set this variable via CFLAGS. --- ...-execute-scripts-in-etc-systemd-syst.patch | 23 ------------------- pkgs/os-specific/linux/systemd/default.nix | 8 +++++-- 2 files changed, 6 insertions(+), 25 deletions(-) delete mode 100644 pkgs/os-specific/linux/systemd/0010-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch diff --git a/pkgs/os-specific/linux/systemd/0010-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch b/pkgs/os-specific/linux/systemd/0010-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch deleted file mode 100644 index 5de6a93cd7f9..000000000000 --- a/pkgs/os-specific/linux/systemd/0010-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch +++ /dev/null @@ -1,23 +0,0 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 -From: Nikolay Amiantov -Date: Thu, 25 Jul 2019 20:45:55 +0300 -Subject: [PATCH] systemd-shutdown: execute scripts in - /etc/systemd/system-shutdown - -This is needed for NixOS to use such scripts as systemd directory is immutable. ---- - src/shutdown/shutdown.c | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/src/shutdown/shutdown.c b/src/shutdown/shutdown.c -index fc6df238be..cb8b45a41b 100644 ---- a/src/shutdown/shutdown.c -+++ b/src/shutdown/shutdown.c -@@ -330,6 +330,7 @@ static void notify_supervisor(void) { - int main(int argc, char *argv[]) { - static const char* const dirs[] = { - SYSTEM_SHUTDOWN_PATH, -+ "/etc/systemd/system-shutdown", - NULL - }; - _cleanup_free_ char *cgroup = NULL; diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix index 812d7227a48c..67c27eee878c 100644 --- a/pkgs/os-specific/linux/systemd/default.nix +++ b/pkgs/os-specific/linux/systemd/default.nix @@ -240,7 +240,6 @@ stdenv.mkDerivation (finalAttrs: { ./0002-Don-t-try-to-unmount-nix-or-nix-store.patch ./0007-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch ./0009-add-rootprefix-to-lookup-dir-paths.patch - ./0010-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch ./0011-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch ./0012-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch ./0013-inherit-systemd-environment-when-calling-generators.patch @@ -707,12 +706,17 @@ stdenv.mkDerivation (finalAttrs: { # warning messages postConfigure = '' substituteInPlace config.h \ - --replace-fail "SYSTEMD_BINARY_PATH" "_SYSTEMD_BINARY_PATH" + --replace-fail "SYSTEMD_BINARY_PATH" "_SYSTEMD_BINARY_PATH" \ + --replace-fail "SYSTEM_SHUTDOWN_PATH" "_SYSTEM_SHUTDOWN_PATH" ''; env.NIX_CFLAGS_COMPILE = toString [ "-USYSTEMD_BINARY_PATH" "-DSYSTEMD_BINARY_PATH=\"/run/current-system/systemd/lib/systemd/systemd\"" + + # This path is not exposed via meson + "-USYSTEM_SHUTDOWN_PATH" + "-DSYSTEM_SHUTDOWN_PATH=\"/etc/systemd/system-shutdown\"" ]; doCheck = false; From 4f2d03b91ad366ecbffda485dea644369a0bb622 Mon Sep 17 00:00:00 2001 From: nikstur Date: Sun, 8 Feb 2026 16:42:46 +0100 Subject: [PATCH 09/14] systemd: drop 0011-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch Instead set this variable via CFLAGS. --- ...ecute-scripts-in-etc-systemd-system-.patch | 22 ------------------- pkgs/os-specific/linux/systemd/default.nix | 8 +++++-- 2 files changed, 6 insertions(+), 24 deletions(-) delete mode 100644 pkgs/os-specific/linux/systemd/0011-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch diff --git a/pkgs/os-specific/linux/systemd/0011-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch b/pkgs/os-specific/linux/systemd/0011-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch deleted file mode 100644 index 5da56ce4be17..000000000000 --- a/pkgs/os-specific/linux/systemd/0011-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch +++ /dev/null @@ -1,22 +0,0 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 -From: Nikolay Amiantov -Date: Thu, 25 Jul 2019 20:46:58 +0300 -Subject: [PATCH] systemd-sleep: execute scripts in /etc/systemd/system-sleep - -This is needed for NixOS to use such scripts as systemd directory is immutable. ---- - src/sleep/sleep.c | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/src/sleep/sleep.c b/src/sleep/sleep.c -index 43aaede5b0..a8e5a75e39 100644 ---- a/src/sleep/sleep.c -+++ b/src/sleep/sleep.c -@@ -248,6 +248,7 @@ static int execute( - }; - static const char* const dirs[] = { - SYSTEM_SLEEP_PATH, -+ "/etc/systemd/system-sleep", - NULL - }; - diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix index 67c27eee878c..ba15848016da 100644 --- a/pkgs/os-specific/linux/systemd/default.nix +++ b/pkgs/os-specific/linux/systemd/default.nix @@ -240,7 +240,6 @@ stdenv.mkDerivation (finalAttrs: { ./0002-Don-t-try-to-unmount-nix-or-nix-store.patch ./0007-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch ./0009-add-rootprefix-to-lookup-dir-paths.patch - ./0011-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch ./0012-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch ./0013-inherit-systemd-environment-when-calling-generators.patch ./0014-core-don-t-taint-on-unmerged-usr.patch @@ -707,7 +706,8 @@ stdenv.mkDerivation (finalAttrs: { postConfigure = '' substituteInPlace config.h \ --replace-fail "SYSTEMD_BINARY_PATH" "_SYSTEMD_BINARY_PATH" \ - --replace-fail "SYSTEM_SHUTDOWN_PATH" "_SYSTEM_SHUTDOWN_PATH" + --replace-fail "SYSTEM_SHUTDOWN_PATH" "_SYSTEM_SHUTDOWN_PATH" \ + --replace-fail "SYSTEM_SLEEP_PATH" "_SYSTEM_SLEEP_PATH" ''; env.NIX_CFLAGS_COMPILE = toString [ @@ -717,6 +717,10 @@ stdenv.mkDerivation (finalAttrs: { # This path is not exposed via meson "-USYSTEM_SHUTDOWN_PATH" "-DSYSTEM_SHUTDOWN_PATH=\"/etc/systemd/system-shutdown\"" + + # This path is not exposed via meson + "-USYSTEM_SLEEP_PATH" + "-DSYSTEM_SLEEP_PATH=\"/etc/systemd/system-sleep\"" ]; doCheck = false; From e73170e38a27be96071b8da0f18c0e2b150dc627 Mon Sep 17 00:00:00 2001 From: nikstur Date: Mon, 16 Feb 2026 23:30:14 +0100 Subject: [PATCH 10/14] systemd: drop 0013-inherit-systemd-environment-when-calling-generators.patch This is possibile because of the preparations from 4aae99b7d791c4db7a7db534cba10714054c5fdc --- ...-environment-when-calling-generators.patch | 39 ------------------- pkgs/os-specific/linux/systemd/default.nix | 1 - 2 files changed, 40 deletions(-) delete mode 100644 pkgs/os-specific/linux/systemd/0013-inherit-systemd-environment-when-calling-generators.patch diff --git a/pkgs/os-specific/linux/systemd/0013-inherit-systemd-environment-when-calling-generators.patch b/pkgs/os-specific/linux/systemd/0013-inherit-systemd-environment-when-calling-generators.patch deleted file mode 100644 index 4645b2f6d269..000000000000 --- a/pkgs/os-specific/linux/systemd/0013-inherit-systemd-environment-when-calling-generators.patch +++ /dev/null @@ -1,39 +0,0 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 -From: Yuriy Taraday -Date: Fri, 17 Jun 2022 12:45:10 +0000 -Subject: [PATCH] inherit systemd environment when calling generators. - -Systemd generators need access to the environment configured in -stage-2-init.sh since it schedules fsck and mkfs executions based on -being able to find an appropriate binary for the target filesystem. - -With this commit I am altering the systemd behaviour since upstream -tries to gather environments with that they call -"environment-generators" and then seems to pass that on to all the other -executables that are being called from managers. ---- - src/core/manager.c | 8 ++++++++ - 1 file changed, 8 insertions(+) - -diff --git a/src/core/manager.c b/src/core/manager.c -index 2115d74595..86f697313b 100644 ---- a/src/core/manager.c -+++ b/src/core/manager.c -@@ -3999,9 +3999,17 @@ static int build_generator_environment(Manager *m, char ***ret) { - * adjust generated units to that. Let's pass down some bits of information that are easy for us to - * determine (but a bit harder for generator scripts to determine), as environment variables. */ - -+ // On NixOS we must propagate PATH to generators so they are -+ // able to find binaries such as `fsck.${fstype}` and -+ // `mkfs.${fstype}`. That is why we ignore transient_environment that -+ // overrides the PATH variable. This propagates systemd's -+ // environment (e.g. PATH) that was setup -+ // before calling systemd from stage-2-init.sh. -+#if 0 - nl = strv_copy(m->transient_environment); - if (!nl) - return -ENOMEM; -+#endif - - r = strv_env_assign(&nl, "SYSTEMD_SCOPE", runtime_scope_to_string(m->runtime_scope)); - if (r < 0) diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix index ba15848016da..5db5d9136c1f 100644 --- a/pkgs/os-specific/linux/systemd/default.nix +++ b/pkgs/os-specific/linux/systemd/default.nix @@ -241,7 +241,6 @@ stdenv.mkDerivation (finalAttrs: { ./0007-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch ./0009-add-rootprefix-to-lookup-dir-paths.patch ./0012-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch - ./0013-inherit-systemd-environment-when-calling-generators.patch ./0014-core-don-t-taint-on-unmerged-usr.patch ./0015-tpm2_context_init-fix-driver-name-checking.patch ./0016-systemctl-edit-suggest-systemdctl-edit-runtime-on-sy.patch From ab1dc94dd392784b368511840ed103386385a550 Mon Sep 17 00:00:00 2001 From: nikstur Date: Sun, 8 Feb 2026 16:44:09 +0100 Subject: [PATCH 11/14] systemd: drop 0015-tpm2_context_init-fix-driver-name-checking.patch This was fixed when we switched to patching dlopen. --- ...ontext_init-fix-driver-name-checking.patch | 41 ------------------- pkgs/os-specific/linux/systemd/default.nix | 1 - 2 files changed, 42 deletions(-) delete mode 100644 pkgs/os-specific/linux/systemd/0015-tpm2_context_init-fix-driver-name-checking.patch diff --git a/pkgs/os-specific/linux/systemd/0015-tpm2_context_init-fix-driver-name-checking.patch b/pkgs/os-specific/linux/systemd/0015-tpm2_context_init-fix-driver-name-checking.patch deleted file mode 100644 index 2cf174823605..000000000000 --- a/pkgs/os-specific/linux/systemd/0015-tpm2_context_init-fix-driver-name-checking.patch +++ /dev/null @@ -1,41 +0,0 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 -From: Nick Cao -Date: Sun, 15 Jan 2023 20:15:55 +0800 -Subject: [PATCH] tpm2_context_init: fix driver name checking - -https://github.com/systemd/systemd/commit/542dbc623e introduced -additional checks for tpm2 driver names, namely ensuring the driver -name, when concated with "libtss2-tcti-" and ".so.0", generates a valid -filename (with no '/' inside). - -For example, if the driver is name "device", the line - fn = strjoina("libtss2-tcti-", driver, ".so.0") -would yield "libtss2-tcti-device.so.0", passing the check. And the -filename is then passed to dlopen for loading the driver. - -Our current approach for systemd to correctly locate these dynamically -loaded libraries is to patch the filenames to include their absolute -path. Thus the line mentioned above is patched into - fn = strjoina("/nix/store/xxxxxxx-tpm2-tss-3.2.0/lib/libtss2-tcti-", driver, ".so.0") -yielding "/nix/store/xxxxxxx-tpm2-tss-3.2.0/lib/libtss2-tcti-device.so.0", -tripping the check. - -This patch relaxes the check to also accept absolute paths, by replacing -filename_is_valid with path_is_valid. ---- - src/shared/tpm2-util.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/src/shared/tpm2-util.c b/src/shared/tpm2-util.c -index 9e05c847ed..c0dd773eee 100644 ---- a/src/shared/tpm2-util.c -+++ b/src/shared/tpm2-util.c -@@ -918,7 +918,7 @@ int tpm2_context_new(const char *device, Tpm2Context **ret_context) { - return log_oom_debug(); - - /* Better safe than sorry, let's refuse strings that cannot possibly be valid driver early, before going to disk. */ -- if (!filename_is_valid(fn)) -+ if (!path_is_valid(fn)) - return log_debug_errno(SYNTHETIC_ERRNO(EINVAL), "TPM2 driver name '%s' not valid, refusing.", driver); - - const char *dle = NULL; diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix index 5db5d9136c1f..583836a8769e 100644 --- a/pkgs/os-specific/linux/systemd/default.nix +++ b/pkgs/os-specific/linux/systemd/default.nix @@ -242,7 +242,6 @@ stdenv.mkDerivation (finalAttrs: { ./0009-add-rootprefix-to-lookup-dir-paths.patch ./0012-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch ./0014-core-don-t-taint-on-unmerged-usr.patch - ./0015-tpm2_context_init-fix-driver-name-checking.patch ./0016-systemctl-edit-suggest-systemdctl-edit-runtime-on-sy.patch # systemd tries to link the systemd-ssh-proxy ssh config snippet with tmpfiles From 8b5d4b743c0aeb7d8cbd60f372731589e04f289e Mon Sep 17 00:00:00 2001 From: nikstur Date: Sun, 8 Feb 2026 16:45:01 +0100 Subject: [PATCH 12/14] systemd: drop 0016-systemctl-edit-suggest-systemdctl-edit-runtime-on-sy.patch This is entirely a "usability" patch which as per the new patch policy is not allowed. --- nixos/tests/systemd.nix | 11 ----- ...uggest-systemdctl-edit-runtime-on-sy.patch | 45 ------------------- pkgs/os-specific/linux/systemd/default.nix | 1 - 3 files changed, 57 deletions(-) delete mode 100644 pkgs/os-specific/linux/systemd/0016-systemctl-edit-suggest-systemdctl-edit-runtime-on-sy.patch diff --git a/nixos/tests/systemd.nix b/nixos/tests/systemd.nix index 6aa979d41d5a..d04b3a374570 100644 --- a/nixos/tests/systemd.nix +++ b/nixos/tests/systemd.nix @@ -125,17 +125,6 @@ # wait for user services machine.wait_for_unit("default.target", "alice") - with subtest("systemctl edit suggests --runtime"): - # --runtime is suggested when using `systemctl edit` - ret, out = machine.execute("systemctl edit testservice1.service 2>&1") - assert ret == 1 - assert out.rstrip("\n") == "The unit-directory '/etc/systemd/system' is read-only on NixOS, so it's not possible to edit system-units directly. Use 'systemctl edit --runtime' instead." - # editing w/o `--runtime` is possible for user-services, however - # it's not possible because we're not in a tty when grepping - # (i.e. hacky way to ensure that the error from above doesn't appear here). - _, out = machine.execute("systemctl --user edit testservice2.service 2>&1") - assert out.rstrip("\n") == "Cannot edit units interactively if not on a tty." - # Regression test for https://github.com/NixOS/nixpkgs/issues/105049 with subtest("systemd reads timezone database in /etc/zoneinfo"): timer = machine.succeed("TZ=UTC systemctl show --property=TimersCalendar oncalendar-test.timer") diff --git a/pkgs/os-specific/linux/systemd/0016-systemctl-edit-suggest-systemdctl-edit-runtime-on-sy.patch b/pkgs/os-specific/linux/systemd/0016-systemctl-edit-suggest-systemdctl-edit-runtime-on-sy.patch deleted file mode 100644 index e106791f3115..000000000000 --- a/pkgs/os-specific/linux/systemd/0016-systemctl-edit-suggest-systemdctl-edit-runtime-on-sy.patch +++ /dev/null @@ -1,45 +0,0 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 -From: Maximilian Bosch -Date: Fri, 1 Sep 2023 09:57:02 +0200 -Subject: [PATCH] systemctl-edit: suggest `systemdctl edit --runtime` on system - scope - -This is a NixOS-specific change. When trying to modify a unit with -`systemctl edit` on NixOS, it'll fail with "Read-only file system": - - $ systemctl edit libvirtd - Failed to open "/etc/systemd/system/libvirtd.service.d/.#override.conffa9825a0c9a249eb": Read-only file system - -This is because `/etc/systemd/system` is a symlink into the store. In -fact, I'd consider this a feature rather than a bug since this ensures I -don't introduce state imperatively. - -However, people wrongly assume that it's not possible to edit units -ad-hoc and re-deploy their system for quick&dirty debugging where this -would be absolutely fine (and doable with `--runtime` which adds a -transient and non-persistent unit override in `/run`). - -To make sure that people learn about it quicker, this patch -throws an error which suggests using `--runtime` when running -`systemctl edit` on the system scope. - -For the user scope this isn't needed because user-level unit overrides -are written into `$XDG_CONFIG_HOME/systemd/user`. ---- - src/systemctl/systemctl-edit.c | 3 +++ - 1 file changed, 3 insertions(+) - -diff --git a/src/systemctl/systemctl-edit.c b/src/systemctl/systemctl-edit.c -index a28180922a..22c9c8fdbd 100644 ---- a/src/systemctl/systemctl-edit.c -+++ b/src/systemctl/systemctl-edit.c -@@ -336,6 +336,9 @@ int verb_edit(int argc, char *argv[], void *userdata) { - sd_bus *bus = NULL; - int r; - -+ if (!arg_runtime && arg_runtime_scope == RUNTIME_SCOPE_SYSTEM) -+ return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "The unit-directory '/etc/systemd/system' is read-only on NixOS, so it's not possible to edit system-units directly. Use 'systemctl edit --runtime' instead."); -+ - if (!on_tty() && !arg_stdin) - return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Cannot edit units interactively if not on a tty."); - diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix index 583836a8769e..7301f50e86c9 100644 --- a/pkgs/os-specific/linux/systemd/default.nix +++ b/pkgs/os-specific/linux/systemd/default.nix @@ -242,7 +242,6 @@ stdenv.mkDerivation (finalAttrs: { ./0009-add-rootprefix-to-lookup-dir-paths.patch ./0012-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch ./0014-core-don-t-taint-on-unmerged-usr.patch - ./0016-systemctl-edit-suggest-systemdctl-edit-runtime-on-sy.patch # systemd tries to link the systemd-ssh-proxy ssh config snippet with tmpfiles # if the install prefix is not /usr, but that does not work for us From 6e92ac9c5860dcd48a93add5bdabe3d6d840d691 Mon Sep 17 00:00:00 2001 From: nikstur Date: Thu, 9 Apr 2026 20:36:51 +0200 Subject: [PATCH 13/14] systemd: drop 0017-meson-Don-t-link-ssh-dropins.patch --- .../0017-meson-Don-t-link-ssh-dropins.patch | 29 ------------------- pkgs/os-specific/linux/systemd/default.nix | 5 ---- 2 files changed, 34 deletions(-) delete mode 100644 pkgs/os-specific/linux/systemd/0017-meson-Don-t-link-ssh-dropins.patch diff --git a/pkgs/os-specific/linux/systemd/0017-meson-Don-t-link-ssh-dropins.patch b/pkgs/os-specific/linux/systemd/0017-meson-Don-t-link-ssh-dropins.patch deleted file mode 100644 index ffc324be19df..000000000000 --- a/pkgs/os-specific/linux/systemd/0017-meson-Don-t-link-ssh-dropins.patch +++ /dev/null @@ -1,29 +0,0 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 -From: Marie Ramlow -Date: Sun, 24 Nov 2024 20:04:35 +0100 -Subject: [PATCH] meson: Don't link ssh dropins - ---- - meson.build | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/meson.build b/meson.build -index 3672005d75..406be24b45 100644 ---- a/meson.build -+++ b/meson.build -@@ -210,13 +210,13 @@ sshconfdir = get_option('sshconfdir') - if sshconfdir == '' - sshconfdir = sysconfdir / 'ssh/ssh_config.d' - endif --conf.set10('LINK_SSH_PROXY_DROPIN', sshconfdir != 'no' and not sshconfdir.startswith('/usr/')) -+conf.set10('LINK_SSH_PROXY_DROPIN', 0) - - sshdconfdir = get_option('sshdconfdir') - if sshdconfdir == '' - sshdconfdir = sysconfdir / 'ssh/sshd_config.d' - endif --conf.set10('LINK_SSHD_USERDB_DROPIN', sshdconfdir != 'no' and not sshdconfdir.startswith('/usr/')) -+conf.set10('LINK_SSHD_USERDB_DROPIN', 0) - - sshdprivsepdir = get_option('sshdprivsepdir') - conf.set10('CREATE_SSHDPRIVSEPDIR', sshdprivsepdir != 'no' and not sshdprivsepdir.startswith('/usr/')) diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix index 7301f50e86c9..4fa721d41b3f 100644 --- a/pkgs/os-specific/linux/systemd/default.nix +++ b/pkgs/os-specific/linux/systemd/default.nix @@ -242,11 +242,6 @@ stdenv.mkDerivation (finalAttrs: { ./0009-add-rootprefix-to-lookup-dir-paths.patch ./0012-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch ./0014-core-don-t-taint-on-unmerged-usr.patch - - # systemd tries to link the systemd-ssh-proxy ssh config snippet with tmpfiles - # if the install prefix is not /usr, but that does not work for us - # because we include the config snippet manually - ./0017-meson-Don-t-link-ssh-dropins.patch ] ++ lib.optionals (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isGnu) [ ./0018-timesyncd-disable-NSCD-when-DNSSEC-validation-is-dis.patch From 61d3aeeea1da59c8a352154f5f2e65c33a4d0923 Mon Sep 17 00:00:00 2001 From: nikstur Date: Tue, 10 Feb 2026 23:01:24 +0100 Subject: [PATCH 14/14] nixos/rl-notes: add section on removing support for imperatively installed systemd units --- nixos/doc/manual/release-notes/rl-2605.section.md | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/nixos/doc/manual/release-notes/rl-2605.section.md b/nixos/doc/manual/release-notes/rl-2605.section.md index 576f3c6db4c4..d5a65d16fa33 100644 --- a/nixos/doc/manual/release-notes/rl-2605.section.md +++ b/nixos/doc/manual/release-notes/rl-2605.section.md @@ -135,6 +135,17 @@ - `services.pyload` has been removed because the package it relies on does not exist anymore in nixpkgs due to vulnerabilities and being unmaintained. +- Removed the ability from systemd to start units installed via `nix-env -i`. + This feature is hardly used and most units do not work without NixOS specific + changes anyways. Removing this allows us to drop a custom systemd patch + improving systemd maintainability and update speed. + +- Removed the ability from systemd to depend on open-yet-unformatted dm-crypt + devices as systemd device units. For example you cannot call systemd-makefs + on such devices. This was never implemented upstream but patched into + Nixpkgs's systemd. Removing this allows us to drop a custom systemd patch + improving systemd maintainability and update speed. + - `linux_hardened` kernel has been removed due to a lack of maintenance. - `services.tandoor-recipes` now uses a sub-directory for media files by default starting with `26.05`. Existing setups should move media files out of the data directory and adjust `services.tandoor-recipes.extraConfig.MEDIA_ROOT` accordingly. See [Migrating media files for pre 26.05 installations](#module-services-tandoor-recipes-migrating-media).