This repository has no description
1.1 kB
42 lines
1{ pkgs, lib, ... }:
2let
3 pinentry-askpass = pkgs.writeShellScriptBin "pinentry-askpass" ''
4 result=$(cat <<EOF | ${pkgs.pinentry-gtk2}/bin/pinentry
5 SETDESC $1
6 SETPROMPT Passphrase:
7 GETPIN
8 EOF
9 )
10 echo "$result" | grep '^D ' | cut -d' ' -f2-
11 '';
12in
13{
14 security.tpm2 = {
15 enable = true;
16 pkcs11.enable = true;
17 abrmd.enable = true;
18 };
19 environment.systemPackages = [
20 pkgs.keyutils
21 pinentry-askpass
22 ];
23 users.users.mainUser.extraGroups = [ "tss" ];
24
25 systemd.user.services.ssh-tpm-agent = {
26 description = "SSH TPM Agent";
27 wantedBy = [ "graphical-session.target" ];
28 after = [ "graphical-session.target" ];
29 serviceConfig = {
30 ExecStart = "${pkgs.ssh-tpm-agent}/bin/ssh-tpm-agent -l %t/ssh-tpm-agent.sock --no-cache";
31 Environment = [
32 "SSH_ASKPASS=${lib.getExe pinentry-askpass}"
33 "SSH_ASKPASS_REQUIRE=force"
34 ];
35 Restart = "on-failure";
36 };
37 };
38
39 environment.sessionVariables = {
40 SSH_AUTH_SOCK = "\${XDG_RUNTIME_DIR}/ssh-tpm-agent.sock";
41 };
42}