This repository has no description
configs.tpm2: use systemd-user service
author
lassulus
date
(Nov 27, 2025, 7:51 AM CET)
commit
68b75c29
68b75c29d3249bc4d18fd29e14f4a5dae83c5ee0
parent
11567d2f
11567d2f0ed9dc587c3d223fa11938c66204a291
+19
-7
+19
-7
2configs/tpm2.nix
+19
-7
2configs/tpm2.nix
···
1
1
{ pkgs, lib, ... }:
2
2
let
3
3
pinentry-askpass = pkgs.writeShellScriptBin "pinentry-askpass" ''
4
-
# Use pinentry with auto-detection (graphical if available, curses fallback)
5
-
result=$(cat <<EOF | ${pkgs.pinentry-all}/bin/pinentry
4
+
result=$(cat <<EOF | ${pkgs.pinentry-gtk2}/bin/pinentry
6
5
SETDESC $1
7
6
SETPROMPT Passphrase:
8
7
GETPIN
···
18
17
abrmd.enable = true;
19
18
};
20
19
environment.systemPackages = [
21
-
pkgs.ssh-tpm-agent
22
20
pkgs.keyutils
23
21
pinentry-askpass
24
22
];
25
-
environment.variables = {
26
-
SSH_ASKPASS = lib.mkForce "/run/current-system/sw/bin/pinentry-askpass";
27
-
SSH_ASKPASS_REQUIRE = "force";
28
-
};
29
23
users.users.mainUser.extraGroups = [ "tss" ];
24
+
25
+
systemd.user.services.ssh-tpm-agent = {
26
+
description = "SSH TPM Agent";
27
+
wantedBy = [ "graphical-session.target" ];
28
+
after = [ "graphical-session.target" ];
29
+
serviceConfig = {
30
+
ExecStart = "${pkgs.ssh-tpm-agent}/bin/ssh-tpm-agent -l %t/ssh-tpm-agent.sock --no-cache";
31
+
Environment = [
32
+
"SSH_ASKPASS=${lib.getExe pinentry-askpass}"
33
+
"SSH_ASKPASS_REQUIRE=force"
34
+
];
35
+
Restart = "on-failure";
36
+
};
37
+
};
38
+
39
+
environment.sessionVariables = {
40
+
SSH_AUTH_SOCK = "\${XDG_RUNTIME_DIR}/ssh-tpm-agent.sock";
41
+
};
30
42
}