olblak · Jul 1, 2026 · May 28, 2026 · May 28, 2026 · Jun 27, 2026 · Jun 27, 2026
diff --git a/go.mod b/go.mod
@@ -42,6 +42,7 @@ require (
 	github.com/aws/aws-sdk-go-v2/service/ec2 v1.302.0
 	github.com/aws/smithy-go v1.27.2
 	github.com/beevik/etree v1.6.0
+	github.com/coreos/go-systemd/v22 v22.7.0
 	github.com/drone/go-scm v1.42.7
 	github.com/extism/go-sdk v1.7.1
 	github.com/fluxcd/helm-controller/api v1.5.5

diff --git a/pkg/core/pipeline/resource/main.go b/pkg/core/pipeline/resource/main.go
@@ -39,6 +39,7 @@ import (
 	"github.com/updatecli/updatecli/pkg/plugins/resources/shell"
 	stashBranch "github.com/updatecli/updatecli/pkg/plugins/resources/stash/branch"
 	stashTag "github.com/updatecli/updatecli/pkg/plugins/resources/stash/tag"
+	"github.com/updatecli/updatecli/pkg/plugins/resources/systemd"
 	"github.com/updatecli/updatecli/pkg/plugins/resources/temurin"
 	terraformLock "github.com/updatecli/updatecli/pkg/plugins/resources/terraform/lock"
 	terraformProvider "github.com/updatecli/updatecli/pkg/plugins/resources/terraform/provider"
@@ -225,6 +226,10 @@ func New(rs ResourceConfig) (resource Resource, err error) {
 
 		return stashTag.New(rs.Spec)
 
+	case "systemd":
+
+		return systemd.New(rs.Spec)
+
 	case "terraform/file":
 
 		return hcl.New(rs.Spec)
@@ -318,6 +323,7 @@ func GetResourceMapping() map[string]interface{} {
 		"shell":              &shell.Spec{},
 		"stash/branch":       &stashBranch.Spec{},
 		"stash/tag":          &stashTag.Spec{},
+		"systemd":            &systemd.Spec{},
 		"temurin":            &temurin.Spec{},
 		"terraform/file":     &hcl.Spec{},
 		"terraform/lock":     &terraformLock.Spec{},

diff --git a/pkg/plugins/resources/systemd/condition.go b/pkg/plugins/resources/systemd/condition.go
@@ -0,0 +1,77 @@
+package systemd
+
+import (
+	"context"
+	"fmt"
+	"path/filepath"
+
+	"github.com/sirupsen/logrus"
+	"github.com/updatecli/updatecli/pkg/core/pipeline/scm"
+)
+
+func (s *Systemd) Condition(_ context.Context, source string, scm scm.ScmHandler) (pass bool, message string, err error) {
+	expected := s.spec.Value
+	if expected == "" {
+		// Override the default value with the source output when the `spec.value` is not set.
+		expected = source
+	}
+
+	rootDir := ""
+	if scm != nil {
+		rootDir = scm.GetDirectory()
+	}
+
+	filePath := s.spec.File
+	if !filepath.IsAbs(filePath) {
+		filePath = filepath.Join(rootDir, filePath)
+	}
+
+	_, matchingOpts, err := s.readOptions(filePath)
+	if err != nil {
+		return false, "", err
+	}
+
+	if matchingOpts == nil {
+		return false, fmt.Sprintf("option %q not found in section %q in the systemd unit file %q",
+			s.spec.Option, s.spec.Section, filePath), nil
+	}
+
+	optIndex := 0
+	if s.spec.Index != nil {
+		optIndex = *s.spec.Index
+	}
+
+	switch s.spec.Index {
+	case nil:
+		totalNotMatchingOpts := 0
+		for i, opt := range matchingOpts {
+			if opt.Section == s.spec.Section && opt.Name == s.spec.Option {
+				if expected != opt.Value {
+					logrus.Debugf("option %d %q value %q doesn't match expected value %q",
+						i, opt.Name, opt.Value, expected)
+					totalNotMatchingOpts++
+				}
+			}
+		}
+
+		if totalNotMatchingOpts > 0 {
+			return false, fmt.Sprintf("%d option(s) %q value(s) doesn't match expected value %q",
+				totalNotMatchingOpts, s.spec.Option, expected), nil
+		}
+
+	default:
+
+		if optIndex >= len(matchingOpts) {
+			return false, fmt.Sprintf("option %q with index %d not found in section %q in the systemd unit file %q",
+				s.spec.Option, optIndex, s.spec.Section, filePath), nil
+		}
+
+		if matchingOpts[optIndex].Value != expected {
+			return false, fmt.Sprintf("option %q value %q doesn't match expected value %q",
+				matchingOpts[optIndex].Name, matchingOpts[optIndex].Value, expected), nil
+		}
+	}
+
+	return true, fmt.Sprintf("option %q matching value %q found in section %q",
+		matchingOpts[optIndex].Name, matchingOpts[optIndex].Value, matchingOpts[optIndex].Section), nil
+}
diff --git a/pkg/plugins/resources/systemd/condition_test.go b/pkg/plugins/resources/systemd/condition_test.go
@@ -0,0 +1,160 @@
+package systemd
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"github.com/updatecli/updatecli/pkg/core/text"
+)
+
+func TestCondition(t *testing.T) {
+	tests := []struct {
+		name           string
+		spec           Spec
+		source         string
+		mockedContents map[string]string
+		shouldPass     bool
+		wantErr        bool
+	}{
+		{
+			name:   "Value matches from source",
+			source: "nginx:1.25",
+			spec: Spec{
+				File:    "test.container",
+				Section: "Container",
+				Option:  "Image",
+			},
+			mockedContents: map[string]string{
+				"test.container": "[Unit]\nDescription=test\n\n[Container]\nImage=nginx:1.25\n",
+			},
+			shouldPass: true,
+		},
+		{
+			name:   "Value matches from spec.Value",
+			source: "",
+			spec: Spec{
+				File:    "test.container",
+				Section: "Container",
+				Option:  "Image",
+				Value:   "nginx:1.25",
+			},
+			mockedContents: map[string]string{
+				"test.container": "[Unit]\nDescription=test\n\n[Container]\nImage=nginx:1.25\n",
+			},
+			shouldPass: true,
+		},
+		{
+			name:   "Value from spec takes precedence over source",
+			source: "nginx:1.26",
+			spec: Spec{
+				File:    "test.container",
+				Section: "Container",
+				Option:  "Image",
+				Value:   "nginx:1.25",
+			},
+			mockedContents: map[string]string{
+				"test.container": "[Unit]\nDescription=test\n\n[Container]\nImage=nginx:1.25\n",
+			},
+			shouldPass: true,
+		},
+		{
+			name:   "Value matches repeated option index",
+			source: "/etc/wg-easy:/etc/wireguard:rw",
+			spec: Spec{
+				File:    "test.container",
+				Section: "Container",
+				Option:  "Volume",
+				Index:   intPtr(1),
+			},
+			mockedContents: map[string]string{
+				"test.container": "[Container]\nVolume=/lib/modules:/lib/modules:ro\nVolume=/etc/wg-easy:/etc/wireguard:rw\n",
+			},
+			shouldPass: true,
+		},
+		{
+			name:   "Value doesn't matches all repeated option index",
+			source: "/etc/wg-easy:/etc/wireguard:rw",
+			spec: Spec{
+				File:    "test.container",
+				Section: "Container",
+				Option:  "Volume",
+			},
+			mockedContents: map[string]string{
+				"test.container": "[Container]\nVolume=/lib/modules:/lib/modules:ro\nVolume=/etc/wg-easy:/etc/wireguard:rw\n",
+			},
+			shouldPass: false,
+		},
+		{
+			name:   "Value matches all repeated option index",
+			source: "/lib/modules:/lib/modules:ro",
+			spec: Spec{
+				File:    "test.container",
+				Section: "Container",
+				Option:  "Volume",
+			},
+			mockedContents: map[string]string{
+				"test.container": "[Container]\nVolume=/lib/modules:/lib/modules:ro\nVolume=/lib/modules:/lib/modules:ro\n",
+			},
+			shouldPass: true,
+		},
+		{
+			name:   "Value does not match",
+			source: "nginx:1.26",
+			spec: Spec{
+				File:    "test.container",
+				Section: "Container",
+				Option:  "Image",
+			},
+			mockedContents: map[string]string{
+				"test.container": "[Unit]\nDescription=test\n\n[Container]\nImage=nginx:1.25\n",
+			},
+			shouldPass: false,
+		},
+		{
+			name:   "File does not exist",
+			source: "nginx:1.25",
+			spec: Spec{
+				File:    "nonexistent.container",
+				Section: "Container",
+				Option:  "Image",
+			},
+			mockedContents: map[string]string{},
+			wantErr:        true,
+		},
+		{
+			name:   "Option not found in file",
+			source: "nginx:1.25",
+			spec: Spec{
+				File:    "test.container",
+				Section: "Container",
+				Option:  "NonExistent",
+			},
+			mockedContents: map[string]string{
+				"test.container": "[Unit]\nDescription=test\n\n[Container]\nImage=nginx:1.25\n",
+			},
+			wantErr: true,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			mockedText := text.MockTextRetriever{
+				Contents: tt.mockedContents,
+			}
+			s := &Systemd{
+				spec:             tt.spec,
+				contentRetriever: &mockedText,
+			}
+
+			pass, _, err := s.Condition(context.Background(), tt.source, nil)
+			if tt.wantErr {
+				assert.Error(t, err)
+				return
+			}
+
+			require.NoError(t, err)
+			assert.Equal(t, tt.shouldPass, pass)
+		})
+	}
+}
diff --git a/pkg/plugins/resources/systemd/main.go b/pkg/plugins/resources/systemd/main.go
@@ -0,0 +1,98 @@
+package systemd
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/coreos/go-systemd/v22/unit"
+	"github.com/go-viper/mapstructure/v2"
+	"github.com/updatecli/updatecli/pkg/core/result"
+	"github.com/updatecli/updatecli/pkg/core/text"
+)
+
+// intPtr is an helper function to create a pointer to an int value.
+func intPtr(i int) *int {
+	return &i
+}
+
+// Systemd defines a resource of kind "systemd"
+type Systemd struct {
+	spec             Spec
+	contentRetriever text.TextRetriever
+}
+
+// New returns a reference to a newly initialized Systemd object from a Spec
+// or an error if the provided Spec triggers a validation error.
+func New(spec any) (*Systemd, error) {
+	newSpec := Spec{}
+	err := mapstructure.Decode(spec, &newSpec)
+	if err != nil {
+		return nil, err
+	}
+
+	newResource := &Systemd{
+		spec:             newSpec,
+		contentRetriever: &text.Text{},
+	}
+
+	err = newResource.spec.Validate()
+	if err != nil {
+		return nil, err
+	}
+
+	return newResource, nil
+}
+
+// Changelog returns the changelog for this resource, or an empty string if not supported
+func (s *Systemd) Changelog(from, to string) *result.Changelogs {
+	return nil
+}
+
+// ReportConfig returns a new configuration with only the necessary fields
+// to identify the resource without any sensitive information
+// and context specific data.
+func (s *Systemd) ReportConfig() any {
+	return Spec{
+		File:    s.spec.File,
+		Section: s.spec.Section,
+		Option:  s.spec.Option,
+		Index:   s.spec.Index,
+		Value:   s.spec.Value,
+	}
+}
+
+// readOptions reads and parses a systemd unit file, returning all options
+// and the all options matching the configured section/option/index.
+func (s *Systemd) readOptions(filePath string) ([]*unit.UnitOption, []*unit.UnitOption, error) {
+	if !s.contentRetriever.FileExists(filePath) {
+		return nil, nil, fmt.Errorf("the file %q does not exist", filePath)
+	}
+
+	content, err := s.contentRetriever.ReadAll(filePath)
+	if err != nil {
+		return nil, nil, fmt.Errorf("reading systemd unit file: %w", err)
+	}
+
+	opts, err := unit.DeserializeOptions(strings.NewReader(content))
+	if err != nil {
+		return nil, nil, fmt.Errorf("parsing systemd unit file: %w", err)
+	}
+
+	matchingOpts := []*unit.UnitOption{}
+	for _, opt := range opts {
+		if opt.Section == s.spec.Section && opt.Name == s.spec.Option {
+			matchingOpts = append(matchingOpts, opt)
+		}
+	}
+
+	if len(matchingOpts) > 0 {
+		return opts, matchingOpts, nil
+	}
+
+	specIndex := 0
+	if s.spec.Index != nil {
+		specIndex = *s.spec.Index
+	}
+
+	return nil, nil, fmt.Errorf("option %q with index %d not found in section %q", s.spec.Option, specIndex, s.spec.Section)
+}