systemd: enable ssh option

We need to patch systemd to make systemd-ssh-generator(8) work:

- systemd doesn't follow symlinks when checking for a packaged
sshd@.service unit
- systemd tries to link the ssh config dropins by default with tmpfiles
to /usr, that is not possible, so we include the snippet manually.

pkgs/os-specific/linux/systemd/0019-meson-Don-t-link-ssh-dropins.patch

···
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Marie Ramlow <[e-mail]>
+Date: Sun, 24 Nov 2024 20:04:35 +0100
+Subject: [PATCH] meson: Don't link ssh dropins
+
+---
+ meson.build | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/meson.build b/meson.build
+index d392610625..c17d0a1feb 100644
+--- a/meson.build
++++ b/meson.build
+@@ -211,13 +211,13 @@ sshconfdir = get_option('sshconfdir')
+ if sshconfdir == ''
+         sshconfdir = sysconfdir / 'ssh/ssh_config.d'
+ endif
+-conf.set10('LINK_SSH_PROXY_DROPIN', sshconfdir != 'no' and not sshconfdir.startswith('/usr/'))
++conf.set10('LINK_SSH_PROXY_DROPIN', 0)
+ 
+ sshdconfdir = get_option('sshdconfdir')
+ if sshdconfdir == ''
+         sshdconfdir = sysconfdir / 'ssh/sshd_config.d'
+ endif
+-conf.set10('LINK_SSHD_USERDB_DROPIN', sshdconfdir != 'no' and not sshdconfdir.startswith('/usr/'))
++conf.set10('LINK_SSHD_USERDB_DROPIN', 0)
+ 
+ sshdprivsepdir = get_option('sshdprivsepdir')
+ conf.set10('CREATE_SSHDPRIVSEPDIR', sshdprivsepdir != 'no' and not sshdprivsepdir.startswith('/usr/'))
+-- 
+2.47.0
+

pkgs/os-specific/linux/systemd/0020-install-unit_file_exists_full-follow-symlinks.patch

···
+From 7be486fb25dc4ea212cb17f6a3f4a434a557b0d9 Mon Sep 17 00:00:00 2001
+From: Marie Ramlow <[e-mail]>
+Date: Fri, 10 Jan 2025 15:51:33 +0100
+Subject: [PATCH] install: unit_file_exists_full: follow symlinks
+
+---
+ src/shared/install.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/shared/install.c b/src/shared/install.c
+index 53566b7eef..0975cd47c7 100644
+--- a/src/shared/install.c
++++ b/src/shared/install.c
+@@ -3217,7 +3217,7 @@ int unit_file_exists_full(RuntimeScope scope, const LookupPaths *lp, const char
+                         &c,
+                         lp,
+                         name,
+-                        /* flags= */ 0,
++                        /* flags= */ SEARCH_FOLLOW_CONFIG_SYMLINKS,
+                         ret_path ? &info : NULL,
+                         /* changes= */ NULL,
+                         /* n_changes= */ NULL);
+-- 
+2.47.0
+

pkgs/os-specific/linux/systemd/default.nix

···
       ./0016-systemctl-edit-suggest-systemdctl-edit-runtime-on-sy.patch
       ./0017-meson.build-do-not-create-systemdstatedir.patch
       ./0018-Revert-bootctl-update-list-remove-all-instances-of-s.patch # https://github.com/systemd/systemd/issues/33392
+      # systemd tries to link the systemd-ssh-proxy ssh config snippet with tmpfiles
+      # if the install prefix is not /usr, but that does not work for us
+      # because we include the config snippet manually
+      ./0019-meson-Don-t-link-ssh-dropins.patch
+      ./0020-install-unit_file_exists_full-follow-symlinks.patch
     ]
     ++ lib.optionals (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isGnu) [
-      ./0019-timesyncd-disable-NSCD-when-DNSSEC-validation-is-dis.patch
+      ./0021-timesyncd-disable-NSCD-when-DNSSEC-validation-is-dis.patch
     ]
     ++ lib.optionals stdenv.hostPlatform.isMusl (
       let
···
       (lib.mesonOption "umount-path" "${lib.getOutput "mount" util-linux}/bin/umount")
 
       # SSH
-      # Disabled for now until someone makes this work.
-      (lib.mesonOption "sshconfdir" "no")
+      (lib.mesonOption "sshconfdir" "")
       (lib.mesonOption "sshdconfdir" "no")
 
       # Features