forked from
lass.pds.lassul.us/superconfig
This repository has no description
add xerxes tpm key + support
author
lassulus
date
(Dec 12, 2025, 12:09 AM CET)
commit
97e06c53
97e06c5330c8ac90e0f781fc995d90f5da3471e8
parent
fcc7185d
fcc7185d94f6c92cf5dbd12cf41ec0d397871416
+19
-2
+1
keys/age/xerxes.age
+1
keys/age/xerxes.age
···
1
+
age1tpm1qfq23dkwf05xajkyu8jm7x6nls96fxrn2uhfm94ydxlh8xg5u596c08esx2
+15
-2
tools/age-detect/age-detect
+15
-2
tools/age-detect/age-detect
···
17
17
return
18
18
fi
19
19
20
-
# Check for YubiKeys (second priority)
20
+
# Check for TPM on Linux (second priority - built-in, no USB needed)
21
+
# Requires: TPM device, hostname.age with age1tpm1 recipient, and identity in ~/.config/age/
22
+
if [[ -c /dev/tpmrm0 ]] && [[ -f ~/.config/age/tpm-identity.txt ]]; then
23
+
local hostname_key
24
+
hostname_key="${AGE_DETECT_KEYS_DIR:-}/age/$(hostname).age"
25
+
if [[ -f "$hostname_key" ]] && grep -q "^age1tpm1" "$hostname_key" 2>/dev/null; then
26
+
rm -f "$temp_identities"
27
+
echo "DETECTED_KEY=tpm"
28
+
echo "KEY_TYPE=tpm"
29
+
return
30
+
fi
31
+
fi
32
+
33
+
# Check for YubiKeys (third priority)
21
34
if command -v ykman >/dev/null 2>&1; then
22
35
local yubikey_serial
23
36
yubikey_serial=$(ykman info 2>/dev/null | grep "Serial number:" | cut -d: -f2 | tr -d ' ' || true)
···
72
85
echo " DETECTED_KEY=<name> - Name of the detected key (e.g., yubi1, solo2, se)"
73
86
echo " KEY_TYPE=<type> - Type of key (yubikey, solo2, se)"
74
87
echo ""
75
-
echo "Priority order: se > yubikey > solo2"
88
+
echo "Priority order: se > tpm > yubikey > solo2"
76
89
;;
77
90
*)
78
91
echo "Unknown command: $1" >&2
+1
tools/age-detect/flake-module.nix
+1
tools/age-detect/flake-module.nix
+2
tools/pass/flake-module.nix
+2
tools/pass/flake-module.nix
···
14
14
[
15
15
pkgs.age-plugin-fido2-hmac
16
16
pkgs.age-plugin-yubikey
17
+
pkgs.age-plugin-tpm
17
18
self.packages.${system}.pass-otp
18
19
self.packages.${system}.age-detect
19
20
]
···
53
54
export PASSAGE_IDENTITIES_FILE="$PASS_BULK_KEY_FILE"
54
55
else
55
56
# Detect available age keys
57
+
export AGE_DETECT_KEYS_DIR="${self}/keys"
56
58
eval "$(age-detect)"
57
59
58
60
# Set up identity file if detected