From b79e3e615a86a5535c0b00e0b52447bd08343d1d Mon Sep 17 00:00:00 2001
From: WilliButz <wbutz@cyberfnord.de>
Date: Sun, 24 Nov 2019 22:45:39 +0100
Subject: [PATCH 1/4] nixos/networkd: add systemd-network user to group
 systemd-network

---
 nixos/modules/system/boot/networkd.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/nixos/modules/system/boot/networkd.nix b/nixos/modules/system/boot/networkd.nix
index f80d5afc55f..226769f1059 100644
--- a/nixos/modules/system/boot/networkd.nix
+++ b/nixos/modules/system/boot/networkd.nix
@@ -924,6 +924,8 @@ in
 
   config = mkIf config.systemd.network.enable {
 
+    users.users.systemd-network.group = "systemd-network";
+
     systemd.additionalUpstreamSystemUnits = [
       "systemd-networkd.service" "systemd-networkd-wait-online.service"
     ];

From 2ffb2c0bd10e393ec530ecf85d7e01c59d5569d0 Mon Sep 17 00:00:00 2001
From: WilliButz <wbutz@cyberfnord.de>
Date: Sun, 24 Nov 2019 22:46:10 +0100
Subject: [PATCH 2/4] nixos/resolved: add user systemd-resolve to group
 systemd-resolve

---
 nixos/modules/system/boot/resolved.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/nixos/modules/system/boot/resolved.nix b/nixos/modules/system/boot/resolved.nix
index 3ea96f8e464..da61c64faf8 100644
--- a/nixos/modules/system/boot/resolved.nix
+++ b/nixos/modules/system/boot/resolved.nix
@@ -136,6 +136,8 @@ in
       }
     ];
 
+    users.users.resolved.group = "systemd-resolve";
+
     systemd.additionalUpstreamSystemUnits = [
       "systemd-resolved.service"
     ];

From fc91467b0d22603de22c698f80d6217b215e688b Mon Sep 17 00:00:00 2001
From: WilliButz <wbutz@cyberfnord.de>
Date: Sun, 24 Nov 2019 22:46:49 +0100
Subject: [PATCH 3/4] nixos/timesyncd: add user systemd-timesync to group
 systemd-timesync

---
 nixos/modules/system/boot/timesyncd.nix | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/nixos/modules/system/boot/timesyncd.nix b/nixos/modules/system/boot/timesyncd.nix
index 0b1d0ff6c22..9e2f36ca01f 100644
--- a/nixos/modules/system/boot/timesyncd.nix
+++ b/nixos/modules/system/boot/timesyncd.nix
@@ -50,7 +50,10 @@ with lib;
       ${config.services.timesyncd.extraConfig}
     '';
 
-    users.users.systemd-timesync.uid = config.ids.uids.systemd-timesync;
+    users.users.systemd-timesync = {
+      uid = config.ids.uids.systemd-timesync;
+      group = "systemd-timesync";
+    };
     users.groups.systemd-timesync.gid = config.ids.gids.systemd-timesync;
 
     system.activationScripts.systemd-timesyncd-migration = mkIf (versionOlder config.system.stateVersion "19.09") ''

From ec16f4fd5b78edcd11f68cb96b41b9a810af315e Mon Sep 17 00:00:00 2001
From: WilliButz <wbutz@cyberfnord.de>
Date: Mon, 25 Nov 2019 10:47:31 +0100
Subject: [PATCH 4/4] tests/systemd-networkd: add regression test for service
 group

Previously systemd-networkd.service ran as systemd-network:nogroup.
The wireguard private key file is now owned by root:systemd-network with
mode 0640. It is therefore required that the systemd-network user is in the group
with the same name, so that it is able to read the key file.
---
 nixos/tests/systemd-networkd-wireguard.nix | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/nixos/tests/systemd-networkd-wireguard.nix b/nixos/tests/systemd-networkd-wireguard.nix
index b83e9c7ce19..be5c0da981d 100644
--- a/nixos/tests/systemd-networkd-wireguard.nix
+++ b/nixos/tests/systemd-networkd-wireguard.nix
@@ -1,4 +1,4 @@
-let generateNodeConf = { lib, pkgs, config, privkpath, pubk, peerId, nodeId, ...}: {
+let generateNodeConf = { lib, pkgs, config, privk, pubk, peerId, nodeId, ...}: {
       imports = [ common/user-account.nix ];
       systemd.services.systemd-networkd.environment.SYSTEMD_LOG_LEVEL = "debug";
       networking.useNetworkd = true;
@@ -7,13 +7,16 @@ let generateNodeConf = { lib, pkgs, config, privkpath, pubk, peerId, nodeId, ...
       virtualisation.vlans = [ 1 ];
       environment.systemPackages = with pkgs; [ wireguard-tools ];
       boot.extraModulePackages = [ config.boot.kernelPackages.wireguard ];
+      systemd.tmpfiles.rules = [
+        "f /run/wg_priv 0640 root systemd-network - ${privk}"
+      ];
       systemd.network = {
         enable = true;
         netdevs = {
           "90-wg0" = {
             netdevConfig = { Kind = "wireguard"; Name = "wg0"; };
             wireguardConfig = {
-              PrivateKeyFile = privkpath ;
+              PrivateKeyFile = "/run/wg_priv";
               ListenPort = 51820;
               FwMark = 42;
             };
@@ -53,7 +56,7 @@ in import ./make-test-python.nix ({pkgs, ... }: {
   nodes = {
     node1 = { pkgs, ... }@attrs:
     let localConf = {
-        privkpath = pkgs.writeText "priv.key" "GDiXWlMQKb379XthwX0haAbK6hTdjblllpjGX0heP00=";
+        privk = "GDiXWlMQKb379XthwX0haAbK6hTdjblllpjGX0heP00=";
         pubk = "iRxpqj42nnY0Qz8MAQbSm7bXxXP5hkPqWYIULmvW+EE=";
         nodeId = "1";
         peerId = "2";
@@ -62,7 +65,7 @@ in import ./make-test-python.nix ({pkgs, ... }: {
 
     node2 = { pkgs, ... }@attrs:
     let localConf = {
-        privkpath = pkgs.writeText "priv.key" "eHxSI2jwX/P4AOI0r8YppPw0+4NZnjOxfbS5mt06K2k=";
+        privk = "eHxSI2jwX/P4AOI0r8YppPw0+4NZnjOxfbS5mt06K2k=";
         pubk = "27s0OvaBBdHoJYkH9osZpjpgSOVNw+RaKfboT/Sfq0g=";
         nodeId = "2";
         peerId = "1";