This repository has no description
1.4 kB
46 lines
1{
2 pkgs,
3 lib,
4 self,
5 ...
6}:
7let
8 ssh-tpm-agent = self.packages.${pkgs.system}.ssh-tpm-agent;
9 pinentry-rofi = self.packages.${pkgs.system}.pinentry-rofi;
10in
11{
12 security.tpm2 = {
13 enable = true;
14 pkcs11.enable = true;
15 abrmd.enable = true;
16 };
17 environment.systemPackages = [
18 pkgs.keyutils
19 ];
20 users.users.mainUser.extraGroups = [ "tss" ];
21
22 systemd.user.services.ssh-tpm-agent = {
23 description = "SSH TPM Agent";
24 wantedBy = [ "graphical-session.target" ];
25 after = [ "graphical-session.target" ];
26 serviceConfig = {
27 ExecStart = "${ssh-tpm-agent}/bin/ssh-tpm-agent -l %t/ssh-tpm-agent.sock --no-cache";
28 # systemd-launched programs don't source /etc/set-environment; publish
29 # the socket to the user manager like gcr-ssh-agent does.
30 ExecStartPost = "${pkgs.systemd}/bin/systemctl --user set-environment SSH_AUTH_SOCK=%t/ssh-tpm-agent.sock";
31 Environment = [
32 "SSH_ASKPASS=${lib.getExe pinentry-rofi}"
33 "SSH_ASKPASS_REQUIRE=force"
34 ];
35 Restart = "on-failure";
36 };
37 };
38
39 # gnome-keyring (desktops/lib/wayland.nix) pulls in gcr-ssh-agent, which
40 # also sets SSH_AUTH_SOCK in the user manager and would shadow the TPM agent.
41 services.gnome.gcr-ssh-agent.enable = false;
42
43 environment.sessionVariables = {
44 SSH_AUTH_SOCK = "\${XDG_RUNTIME_DIR}/ssh-tpm-agent.sock";
45 };
46}