getent group pkcs11 > /dev/null || groupadd -r pkcs11

systemd-tmpfiles --create opencryptoki.conf

systemctl enable pkcsslotd.service

# FIXME: This should be run when nspawn is launched in boot mode, but there is
# currently no way to distinguish between different container implementations.
if ! systemd-detect-virt --container; then
    systemctl start pkcsslotd.service
fi
