nixos: add service to propagate status of activationScripts

[bjornfor]

Description of changes

This change makes systemctl --failed indicate the result of the NixOS
activation scripts, instead of making their failure only visible if you
(1) manually look at system logs or (2) run the activation script
manually.

I'm re-using the existing /run/nixos directory for the (runtime) state.

Things done

• Built on platform(s)
  • x86_64-linux
  • aarch64-linux
  • x86_64-darwin
  • aarch64-darwin
• For non-Linux: Is sandbox = true set in nix.conf? (See Nix manual)
• Tested, as applicable:
  • NixOS test(s) (look inside nixos/tests)
  • and/or package tests
  • or, for functions and "core" functionality, tests in lib/tests or pkgs/test
  • made sure NixOS tests are linked to the relevant packages
• Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
• Tested basic functionality of all binary files (usually in ./result/bin/)
• 23.05 Release Notes (or backporting 22.11 Release notes)
  • (Package updates) Added a release notes entry if the change is major or breaking
  • (Module updates) Added a release notes entry if the change is significant
  • (Module addition) Added a release notes entry if adding a new NixOS module
  • (Release notes changes) Ran nixos/doc/manual/md-to-db.sh to update generated release notes
• Fits CONTRIBUTING.md.

[nixos-discourse]

This pull request has been mentioned on NixOS Discourse. There might be relevant details there:

https://discourse.nixos.org/t/prs-ready-for-review/3032/1735

[SuperSandro2000]

this feels hacky to me. Could we make this more straight forward?

[bjornfor]

this feels hacky to me. Could we make this more straight forward?

I'm open to ideas.

I guess when we at some point(?) get systemd in stage-1, we'd implement activationScripts as a systemd service and this won't be needed anymore?

But until then, I really think we should have a way to tell systemd about activationScripts failures, like this PR.

[bjornfor]

Ping?

If nobody has anything more to say, I plan to merge in one week.

[infinisil]

I guess when we at some point(?) get systemd in stage-1, we'd implement activationScripts as a systemd service and this won't be needed anymore?

We have that though! #164943

[bjornfor]

I guess when we at some point(?) get systemd in stage-1, we'd implement activationScripts as a systemd service and this won't be needed anymore?

We have that though! #164943

Cool! I didn't know that. I'll try to test it.