Merge pull request #267983 from nikstur/replace-simple-activation-2

nixos: replace activationScripts 2/x

nixos/modules/config/ldap.nix

@@ -226,18 +226,6 @@ in
       "ldap.conf" = ldapConfig;
     };
 
-    system.activationScripts = mkIf (!cfg.daemon.enable) {
-      ldap = stringAfter [ "etc" "groups" "users" ] ''
-        if test -f "${cfg.bind.passwordFile}" ; then
-          umask 0077
-          conf="$(mktemp)"
-          printf 'bindpw %s\n' "$(cat ${cfg.bind.passwordFile})" |
-          cat ${ldapConfig.source} - >"$conf"
-          mv -fT "$conf" /etc/ldap.conf
-        fi
-      '';
-    };
-
     system.nssModules = mkIf cfg.nsswitch (singleton (
       if cfg.daemon.enable then nss_pam_ldapd else nss_ldap
     ));
@@ -258,7 +246,28 @@ in
       };
     };
 
-    systemd.services = mkIf cfg.daemon.enable {
+    systemd.services = mkMerge [
+      (mkIf (!cfg.daemon.enable) {
+        ldap-password = {
+          wantedBy = [ "sysinit.target" ];
+          before = [ "sysinit.target" "shutdown.target" ];
+          conflicts = [ "shutdown.target" ];
+          unitConfig.DefaultDependencies = false;
+          serviceConfig.Type = "oneshot";
+          serviceConfig.RemainAfterExit = true;
+          script = ''
+            if test -f "${cfg.bind.passwordFile}" ; then
+              umask 0077
+              conf="$(mktemp)"
+              printf 'bindpw %s\n' "$(cat ${cfg.bind.passwordFile})" |
+              cat ${ldapConfig.source} - >"$conf"
+              mv -fT "$conf" /etc/ldap.conf
+            fi
+          '';
+        };
+      })
+
+      (mkIf cfg.daemon.enable {
         nslcd = {
           wantedBy = [ "multi-user.target" ];
 
@@ -292,8 +301,8 @@ in
             AmbientCapabilities = "CAP_SYS_RESOURCE";
           };
         };
-
+      })
-    };
+    ];
 
   };
 

nixos/modules/config/nix-channel.nix

@@ -12,7 +12,6 @@ let
     mkDefault
     mkIf
     mkOption
-    stringAfter
     types
     ;
 

nixos/modules/hardware/video/amdgpu-pro.nix

@@ -39,9 +39,10 @@ in
 
     hardware.firmware = [ package.fw ];
 
-    system.activationScripts.setup-amdgpu-pro = ''
+    systemd.tmpfiles.settings.amdgpu-pro = {
-      ln -sfn ${package}/opt/amdgpu{,-pro} /run
+      "/run/amdgpu"."L+".argument = "${package}/opt/amdgpu";
-    '';
+      "/run/amdgpu-pro"."L+".argument = "${package}/opt/amdgpu-pro";
+    };
 
     system.requiredKernelConfig = with config.lib.kernelConfig; [
       (isYes "DEVICE_PRIVATE")

nixos/modules/security/ipa.nix

@@ -181,7 +181,14 @@ in {
       '';
     };
 
-    system.activationScripts.ipa = stringAfter ["etc"] ''
+    systemd.services."ipa-activation" = {
+      wantedBy = [ "sysinit.target" ];
+      before = [ "sysinit.target" "shutdown.target" ];
+      conflicts = [ "shutdown.target" ];
+      unitConfig.DefaultDependencies = false;
+      serviceConfig.Type = "oneshot";
+      serviceConfig.RemainAfterExit = true;
+      script = ''
         # libcurl requires a hard copy of the certificate
         if ! ${pkgs.diffutils}/bin/diff ${cfg.certificate} /etc/ipa/ca.crt > /dev/null 2>&1; then
           rm -f /etc/ipa/ca.crt
@@ -200,6 +207,7 @@ in {
         EOF
         fi
       '';
+    };
 
     services.sssd.config = ''
       [domain/${cfg.domain}]

nixos/modules/security/wrappers/default.nix

@@ -280,6 +280,7 @@ in
       wantedBy = [ "sysinit.target" ];
       before = [ "sysinit.target" "shutdown.target" ];
       conflicts = [ "shutdown.target" ];
+      after = [ "systemd-sysusers.service" ];
       unitConfig.DefaultDependencies = false;
       unitConfig.RequiresMountsFor = [ "/nix/store" "/run/wrappers" ];
       serviceConfig.Type = "oneshot";

nixos/modules/services/backup/borgbackup.nix

@@ -143,20 +143,15 @@ let
   };
 
   # Paths listed in ReadWritePaths must exist before service is started
-  mkActivationScript = name: cfg:
+  mkTmpfiles = name: cfg:
     let
-      install = "install -o ${cfg.user} -g ${cfg.group}";
+      settings = { inherit (cfg) user group; };
-    in
+    in lib.nameValuePair "borgbackup-job-${name}" ({
-      nameValuePair "borgbackup-job-${name}" (stringAfter [ "users" ] (''
+      "${config.users.users."${cfg.user}".home}/.config/borg".d = settings;
-        # Ensure that the home directory already exists
+      "${config.users.users."${cfg.user}".home}/.cache/borg".d = settings;
-        # We can't assert createHome == true because that's not the case for root
+    } // optionalAttrs (isLocalPath cfg.repo && !cfg.removableDevice) {
-        cd "${config.users.users.${cfg.user}.home}"
+      "${cfg.repo}".d = settings;
-        # Create each directory separately to prevent root owned parent dirs
+    });
-        ${install} -d .config .config/borg
-        ${install} -d .cache .cache/borg
-      '' + optionalString (isLocalPath cfg.repo && !cfg.removableDevice) ''
-        ${install} -d ${escapeShellArg cfg.repo}
-      ''));
 
   mkPassAssertion = name: cfg: {
     assertion = with cfg.encryption;
@@ -760,7 +755,7 @@ in {
         ++ mapAttrsToList mkSourceAssertions jobs
         ++ mapAttrsToList mkRemovableDeviceAssertions jobs;
 
-      system.activationScripts = mapAttrs' mkActivationScript jobs;
+      systemd.tmpfiles.settings = mapAttrs' mkTmpfiles jobs;
 
       systemd.services =
         # A job named "foo" is mapped to systemd.services.borgbackup-job-foo

nixos/modules/services/logging/logcheck.nix

@@ -220,10 +220,16 @@ in
       logcheck = {};
     };
 
-    system.activationScripts.logcheck = ''
+    systemd.tmpfiles.settings.logcheck = {
-      mkdir -m 700 -p /var/{lib,lock}/logcheck
+      "/var/lib/logcheck".d = {
-      chown ${cfg.user} /var/{lib,lock}/logcheck
+        mode = "700";
-    '';
+        inherit (cfg) user;
+      };
+      "/var/lock/logcheck".d = {
+        mode = "700";
+        inherit (cfg) user;
+      };
+    };
 
     services.cron.systemCronJobs =
         let withTime = name: {timeArgs, ...}: timeArgs != null;

nixos/modules/services/networking/yggdrasil.nix

@@ -137,7 +137,14 @@ in
         message = "networking.enableIPv6 must be true for yggdrasil to work";
       }];
 
-      system.activationScripts.yggdrasil = mkIf cfg.persistentKeys ''
+      # This needs to be a separate service. The yggdrasil service fails if
+      # this is put into its preStart.
+      systemd.services.yggdrasil-persistent-keys = lib.mkIf cfg.persistentKeys {
+        wantedBy = [ "multi-user.target" ];
+        before = [ "yggdrasil.service" ];
+        serviceConfig.Type = "oneshot";
+        serviceConfig.RemainAfterExit = true;
+        script = ''
           if [ ! -e ${keysPath} ]
           then
             mkdir --mode=700 -p ${builtins.dirOf keysPath}
@@ -147,6 +154,7 @@ in
               > ${keysPath}
           fi
         '';
+      };
 
       systemd.services.yggdrasil = {
         description = "Yggdrasil Network Service";

nixos/modules/system/boot/binfmt.nix

@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 let
-  inherit (lib) mkOption mkDefault types optionalString stringAfter;
+  inherit (lib) mkOption mkDefault types optionalString;
 
   cfg = config.boot.binfmt;
 

nixos/modules/tasks/trackpoint.nix

@@ -80,10 +80,17 @@ with lib;
         ACTION=="add|change", SUBSYSTEM=="input", ATTR{name}=="${cfg.device}", ATTR{device/speed}="${toString cfg.speed}", ATTR{device/sensitivity}="${toString cfg.sensitivity}"
       '';
 
-      system.activationScripts.trackpoint =
+      systemd.services.trackpoint = {
-        ''
+        wantedBy = [ "sysinit.target" ] ;
-          ${config.systemd.package}/bin/udevadm trigger --attr-match=name="${cfg.device}"
+        before = [ "sysinit.target" "shutdown.target" ];
+        conflicts = [ "shutdown.target" ];
+        unitConfig.DefaultDependencies = false;
+        serviceConfig.Type = "oneshot";
+        serviceConfig.RemainAfterExit = true;
+        serviceConfig.ExecStart = ''
+          ${config.systemd.package}/bin/udevadm trigger --attr-match=name="${cfg.device}
         '';
+      };
     })
 
     (mkIf (cfg.emulateWheel) {

nixos/modules/virtualisation/vmware-host.nix

@@ -85,11 +85,21 @@ in
       };
     };
 
-    ###### wrappers activation script
+    # Services
 
-    system.activationScripts.vmwareWrappers =
+    systemd.services."vmware-wrappers" = {
-      lib.stringAfter [ "specialfs" "users" ]
+      description = "Create VMVare Wrappers";
-        ''
+      wantedBy = [ "multi-user.target" ];
+      before = [
+        "vmware-authdlauncher.service"
+        "vmware-networks-configuration.service"
+        "vmware-networks.service"
+        "vmware-usbarbitrator.service"
+      ];
+      after = [ "systemd-sysusers.service" ];
+      serviceConfig.Type = "oneshot";
+      serviceConfig.RemainAfterExit = true;
+      script = ''
         mkdir -p "${parentWrapperDir}"
         chmod 755 "${parentWrapperDir}"
         # We want to place the tmpdirs for the wrappers to the parent dir.
@@ -111,8 +121,7 @@ in
           ln --symbolic "$wrapperDir" "${wrapperDir}"
         fi
       '';
-
+    };
-    # Services
 
     systemd.services."vmware-authdlauncher" = {
       description = "VMware Authentication Daemon";

nixos/tests/incron.nix

@@ -13,9 +13,9 @@ import ./make-test-python.nix ({ pkgs, lib, ... }:
       '';
 
       # ensure the directory to be monitored exists before incron is started
-      system.activationScripts.incronTest = ''
+      systemd.tmpfiles.settings.incron-test = {
-        mkdir /test
+        "/test".d = { };
-      '';
+      };
     };
 
   testScript = ''

nixos/tests/nextcloud/basic.nix

@@ -13,10 +13,12 @@ in {
     # The only thing the client needs to do is download a file.
     client = { ... }: {
       services.davfs2.enable = true;
-      system.activationScripts.davfs2-secrets = ''
+      systemd.tmpfiles.settings.nextcloud = {
-        echo "http://nextcloud/remote.php/dav/files/${adminuser} ${adminuser} ${adminpass}" > /tmp/davfs2-secrets
+        "/tmp/davfs2-secrets"."f+" = {
-        chmod 600 /tmp/davfs2-secrets
+          mode = "0600";
-      '';
+          argument = "http://nextcloud/remote.php/dav/files/${adminuser} ${adminuser} ${adminpass}";
+        };
+      };
       virtualisation.fileSystems = {
         "/mnt/dav" = {
           device = "http://nextcloud/remote.php/dav/files/${adminuser}";