nixos/systemd: conditionally leave out some upstream units

[jmbaur]

Some upstream systemd units are conditionally installed into the systemd output, so we must make sure the feature that enables their installation is enabled on our side prior to trying to use them.

Things done

• Built on platform(s)
  • x86_64-linux
  • aarch64-linux
  • x86_64-darwin
  • aarch64-darwin
• For non-Linux: Is sandboxing enabled in nix.conf? (See Nix manual)
  • sandbox = relaxed
  • sandbox = true
• Tested, as applicable:
  • NixOS test(s) (look inside nixos/tests)
  • and/or package tests
  • or, for functions and "core" functionality, tests in lib/tests or pkgs/test
  • made sure NixOS tests are linked to the relevant packages
• Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
• Tested basic functionality of all binary files (usually in ./result/bin/)
• 25.05 Release Notes (or backporting 24.11 and 25.05 Release notes)
  • (Package updates) Added a release notes entry if the change is major or breaking
  • (Module updates) Added a release notes entry if the change is significant
  • (Module addition) Added a release notes entry if adding a new NixOS module
• Fits CONTRIBUTING.md.

---

Add a 👍 reaction to pull requests you find important.

[jmbaur]

gentle ping @NixOS/systemd

[ElvishJerricco]

Do the TPM2 features really require building systemd-boot? There's a lot of TPM2 features in systemd that have nothing to do with systemd-boot. Most of them, in fact.

[ElvishJerricco]

Huh, apparently it does. In fact, it seems to require openssl too, which I suppose isn't surprising.

Frankly, I think this means that we should actually have assertions in systemd/default.nix like assert withTpm2Tss -> withBootloader && withOpenSSL;, rather than adding conditional logic to these modules.

[ElvishJerricco]

The other, non-tpm2 parts of this PR look good though.

[ElvishJerricco]

Ah, no, that's wrong. There are parts of systemd that use the TPM2 without requiring boot loader stuff, like systemd-creds. So an assertion in the package expression is wrong.

Regardless, it still seems like we need to add withOpenSSL to these checks, right? Maybe we could add an extra passthru like withTpm2Units = withTpm2Tss && withBootloader && withOpenSSL or something.

[jmbaur]

@ElvishJerricco applied your suggestions! Added changes to the systemd packge, though they all exist in passthru, so we shouldn't incur the cost of a rebuild.