strongswan: enable charon-systemd (#21872)

See: https://wiki.strongswan.org/projects/strongswan/wiki/Charon-systemd

pkgs/tools/networking/strongswan/default.nix

@@ -1,6 +1,6 @@
 { stdenv, fetchurl, gmp, pkgconfig, python, autoreconfHook
 , curl, trousers, sqlite, iptables, libxml2, openresolv
-, ldns, unbound, pcsclite, openssl
+, ldns, unbound, pcsclite, openssl, systemd
 , enableTNC ? false }:
 
 stdenv.mkDerivation rec {
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
   dontPatchELF = true;
 
   buildInputs =
-    [ gmp pkgconfig python autoreconfHook iptables ldns unbound openssl pcsclite ]
+    [ gmp pkgconfig python autoreconfHook iptables ldns unbound openssl pcsclite systemd.dev ]
     ++ stdenv.lib.optionals enableTNC [ curl trousers sqlite libxml2 ];
 
   patches = [
@@ -26,10 +26,21 @@ stdenv.mkDerivation rec {
 
   postPatch = ''
     substituteInPlace src/libcharon/plugins/resolve/resolve_handler.c --replace "/sbin/resolvconf" "${openresolv}/sbin/resolvconf"
+
+    # swanctl can be configured by files in SWANCTLDIR which defaults to
+    # $out/etc/swanctl. Since that directory is in the nix store users can't
+    # modify it. Ideally swanctl accepts a command line option for specifying
+    # the configuration files. In the absence of that we patch swanctl to look
+    # for configuration files in /etc/swanctl.
+    substituteInPlace src/swanctl/swanctl.h --replace "SWANCTLDIR" "\"/etc/swanctl\""
+    '';
+
+  preConfigure = ''
+    configureFlagsArray+=("--with-systemdsystemunitdir=$out/etc/systemd/system")
   '';
 
   configureFlags =
-    [ "--enable-swanctl" "--enable-cmd"
+    [ "--enable-swanctl" "--enable-cmd" "--enable-systemd"
       "--enable-farp" "--enable-dhcp"
       "--enable-eap-sim" "--enable-eap-sim-file" "--enable-eap-simaka-pseudonym"
       "--enable-eap-simaka-reauth" "--enable-eap-identity" "--enable-eap-md5"