forked from
lass.pds.lassul.us/superconfig
This repository has no description
tpm2: use ssh-tpm-agent
author
lassulus
date
(Nov 23, 2025, 8:31 PM +0700)
commit
e5c21fef
e5c21fef2eb9e34932baf03a9c6bdb57a96ea3b4
parent
7ed0971f
7ed0971f83a29f7ade5a7f9f8c77d9f6bf4a46f0
+22
-2
+22
-2
2configs/tpm2.nix
+22
-2
2configs/tpm2.nix
···
1
-
{ pkgs, ... }: {
1
+
{ pkgs, lib, ... }:
2
+
let
3
+
pinentry-askpass = pkgs.writeShellScriptBin "pinentry-askpass" ''
4
+
# Use pinentry with auto-detection (graphical if available, curses fallback)
5
+
result=$(cat <<EOF | ${pkgs.pinentry-all}/bin/pinentry
6
+
SETDESC $1
7
+
SETPROMPT Passphrase:
8
+
GETPIN
9
+
EOF
10
+
)
11
+
echo "$result" | grep '^D ' | cut -d' ' -f2-
12
+
'';
13
+
in
14
+
{
2
15
security.tpm2 = {
3
16
enable = true;
4
17
pkcs11.enable = true;
5
18
abrmd.enable = true;
6
19
};
7
20
environment.systemPackages = [
8
-
pkgs.tpm2-tools
21
+
pkgs.ssh-tpm-agent
22
+
pkgs.keyutils
23
+
pinentry-askpass
9
24
];
25
+
environment.variables = {
26
+
SSH_ASKPASS = lib.mkForce "/run/current-system/sw/bin/pinentry-askpass";
27
+
SSH_ASKPASS_REQUIRE = "force";
28
+
};
29
+
users.users.mainUser.extraGroups = [ "tss" ];
10
30
}