From 561f1f7a6ea59a905598c8d1706787690825ec70 Mon Sep 17 00:00:00 2001 From: Jared Baur Date: Wed, 19 Mar 2025 08:13:43 -0700 Subject: [PATCH 1/2] systemd: expose withTpm2Units Exposes if a special trio of options are enabled in the systemd build, for convenience when accessing in NixOS modules. --- pkgs/os-specific/linux/systemd/default.nix | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix index db21f9fb7d54..8abead4eeddc 100644 --- a/pkgs/os-specific/linux/systemd/default.nix +++ b/pkgs/os-specific/linux/systemd/default.nix @@ -892,6 +892,10 @@ stdenv.mkDerivation (finalAttrs: { kbd ; + # Many TPM2-related units are only installed if this trio of features are + # enabled. See https://github.com/systemd/systemd/blob/876ee10e0eb4bbb0920bdab7817a9f06cc34910f/units/meson.build#L521 + withTpm2Units = withTpm2Tss && withBootloader && withOpenSSL; + tests = let # Some entries in the `nixosTests.systemd-*` set of attributes are collections of tests, From dad880d6bf01319b3b0dabb05e89c2a46b7365f3 Mon Sep 17 00:00:00 2001 From: Jared Baur Date: Wed, 19 Mar 2025 08:14:48 -0700 Subject: [PATCH 2/2] nixos/systemd: conditionally leave out some upstream units Some upstream systemd units are conditionally installed into the systemd output, so we must make sure the feature that enables their installation is enabled on our side prior to trying to use them. --- nixos/modules/system/boot/systemd.nix | 6 ++++-- nixos/modules/system/boot/systemd/tpm2.nix | 8 ++++---- 2 files changed, 8 insertions(+), 6 deletions(-) diff --git a/nixos/modules/system/boot/systemd.nix b/nixos/modules/system/boot/systemd.nix index 3096517c0b08..3b4bdaae071e 100644 --- a/nixos/modules/system/boot/systemd.nix +++ b/nixos/modules/system/boot/systemd.nix @@ -104,7 +104,7 @@ let "sleep.target" "hybrid-sleep.target" "systemd-hibernate.service" - "systemd-hibernate-clear.service" + ] ++ (lib.optional cfg.package.withEfi "systemd-hibernate-clear.service") ++ [ "systemd-hybrid-sleep.service" "systemd-suspend.service" "systemd-suspend-then-hibernate.service" @@ -130,11 +130,13 @@ let "systemd-ask-password-wall.service" # Varlink APIs + ] ++ lib.optionals cfg.package.withBootloader [ "systemd-bootctl@.service" "systemd-bootctl.socket" + ] ++ [ "systemd-creds@.service" "systemd-creds.socket" - ] ++ lib.optional cfg.package.withTpm2Tss [ + ] ++ lib.optional cfg.package.withTpm2Units [ "systemd-pcrlock@.service" "systemd-pcrlock.socket" ] ++ [ diff --git a/nixos/modules/system/boot/systemd/tpm2.nix b/nixos/modules/system/boot/systemd/tpm2.nix index 6b6c9fb23f24..8bf3b8413574 100644 --- a/nixos/modules/system/boot/systemd/tpm2.nix +++ b/nixos/modules/system/boot/systemd/tpm2.nix @@ -27,13 +27,13 @@ options = { systemd.tpm2.enable = lib.mkEnableOption "systemd TPM2 support" // { - default = config.systemd.package.withTpm2Tss; - defaultText = "systemd.package.withTpm2Tss"; + default = config.systemd.package.withTpm2Units; + defaultText = "systemd.package.withTpm2Units"; }; boot.initrd.systemd.tpm2.enable = lib.mkEnableOption "systemd initrd TPM2 support" // { - default = config.boot.initrd.systemd.package.withTpm2Tss; - defaultText = "boot.initrd.systemd.package.withTpm2Tss"; + default = config.boot.initrd.systemd.package.withTpm2Units; + defaultText = "boot.initrd.systemd.package.withTpm2Units"; }; };