add tpm2 support

modules/sys/rc/openssh.nix

@@ -1,6 +1,10 @@
 {
+  programs.ssh = {
+    startAgent = true;
+    agentPKCS11Whitelist = "${config.security.tpm2.pkcs11.package}/lib/*,/run/current-system/sw/lib/*";
+  };
   services.openssh = {
     enable = true;
     settings.PasswordAuthentication = true;
   };
-}
+}

modules/sys/security.nix

@@ -3,6 +3,11 @@
     sudo.execWheelOnly = true;
     polkit.enable = true;
     protectKernelImage = true;
+    tpm = {
+      enable = true;
+      pkcs11.enable = true;
+      tctiEnvironment.enable = true;
+    };
   };
   system.autoUpgrade = {
     enable = true;

modules/sys/users/juliet.nix

@@ -2,8 +2,8 @@
   users.users.juliet = {
     description = "Juliet";
     isNormalUser = true;
-    extraGroups = [ "audio" "video" "bluetooth" "wheel" "input" "networkmanager" "scanner" "lp" ];
+    extraGroups = [ "audio" "video" "bluetooth" "wheel" "input" "networkmanager" "scanner" "lp" "tss" ];
     initialPassword = "password";
     linger = true;
   };
-}
+}

modules/sys/users/k3t.nix

@@ -2,11 +2,12 @@
   users.users.k3t = {
     description = "Kai Moore";
     isNormalUser = true;
-    extraGroups = [ "audio" "video" "bluetooth" "wheel" "input" "networkmanager" "scanner" "lp" ];
+    extraGroups = [ "audio" "video" "bluetooth" "wheel" "input" "networkmanager" "scanner" "lp" "tss" ];
     initialPassword = "password";
     linger = true;
     openssh.authorizedKeys.keys = [
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIG6evv6KcTvFDp4EeO9mMAa2Pb7yYZ/uTNM6TrVt5nKc k3t@DESKTOP-GTFSBKP" # TBB Win10
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIG6evv6KcTvFDp4EeO9mMAa2Pb7yYZ/uTNM6TrVt5nKc k3t@TheBlackBox" # TBB
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO1DAk3isgJPJbo19Kto6EnZdDMIe6F6D/BLyhhQPmBd k3t@T14" # T14
     ];
   };
-}
+}