Fix stuff

docs/TODO.md

@@ -157,6 +157,11 @@ boot LAN.
     `nvme connect-all` until the namespace appears. The dracut module installs
     the unit + script and enables it via an `initrd-root-device.target.wants`
     symlink; `diskless.pkr.hcl` hard-asserts the unit is in the initramfs.
+    Gotcha: `$systemdsystemunitdir` is **empty** in this dracut's module-setup
+    context — `inst_simple` then silently drops the unit (empty dest dir). Use a
+    `${systemdsystemunitdir:-/usr/lib/systemd/system}` fallback and `return 1`
+    if the unit didn't land, so the build fails loudly instead of shipping a UKI
+    that can't connect its root.
     **⚠ The secure path has the same dependency on the
     (absent) nvmf autoconnect** — when 802.1X is re-enabled, the macsec0 path
     must likewise drive `connect-all` (or the network-manager port #1 must wire

files/dracut/95dot1x-macsec/module-setup.sh

@@ -51,11 +51,22 @@ install() {
     # deterministically. ConditionKernelCommandLine=rd.dot1x=0 makes it a no-op
     # on the secure path.
     inst_simple "$moddir/nvmf-connect.sh" /usr/sbin/nvmf-connect
-    inst_simple "$moddir/nvmf-connect.service" \
-        "$systemdsystemunitdir/nvmf-connect.service"
-    mkdir -p "${initdir}${systemdsystemunitdir}/initrd-root-device.target.wants"
+
+    # systemdsystemunitdir is normally /usr/lib/systemd/system, but dracut does
+    # not reliably export it into module-setup context here — when empty,
+    # inst_simple's dir handling silently DROPS the unit (the bug that left the
+    # initramfs without nvmf-connect.service). Fall back to the canonical path.
+    local _unitdir="${systemdsystemunitdir:-/usr/lib/systemd/system}"
+    inst_simple "$moddir/nvmf-connect.service" "${_unitdir}/nvmf-connect.service"
+    mkdir -p "${initdir}${_unitdir}/initrd-root-device.target.wants"
     ln -sf ../nvmf-connect.service \
-        "${initdir}${systemdsystemunitdir}/initrd-root-device.target.wants/nvmf-connect.service"
+        "${initdir}${_unitdir}/initrd-root-device.target.wants/nvmf-connect.service"
+    # Hard-fail the dracut build if the unit didn't land — never ship a UKI that
+    # silently can't connect its NVMe-oF root in test mode.
+    if [ ! -e "${initdir}${_unitdir}/nvmf-connect.service" ]; then
+        derror "95dot1x-macsec: nvmf-connect.service not installed into ${_unitdir}"
+        return 1
+    fi
 
     dracut_need_initqueue
 }