Move TPM related code to hardware x86_64-generic as hardware dependen…

…t module. Signed-off-by: Manuel Bluhm <[email protected]>
tiiuae · May 9, 2024 · 3831db6 · 3831db6
1 parent a4f747c
commit 3831db6
Show file tree

Hide file tree

Showing 5 changed files with 5 additions and 6 deletions.
diff --git a/modules/common/default.nix b/modules/common/default.nix
@@ -11,7 +11,6 @@
     ./firewall
     ./profiles
     ./security
-    ./tpm2
     ./users/accounts.nix
     ./version
     ./virtualization/docker.nix

diff --git a/modules/common/users/accounts.nix b/modules/common/users/accounts.nix
@@ -40,7 +40,7 @@ in
           extraGroups =
             ["wheel" "video" "networkmanager"]
             ++ optionals
-            config.ghaf.security.tpm2.enable ["tss"];
+            config.security.tpm2.enable ["tss"];
         };
         groups."${cfg.user}" = {
           name = cfg.user;

diff --git a/modules/hardware/x86_64-generic/default.nix b/modules/hardware/x86_64-generic/default.nix
@@ -7,5 +7,6 @@
     ./kernel/host
     ./kernel/host/pkvm
     ./x86_64-linux.nix
+    ./modules/tpm2.nix
   ];
 }
diff --git a/modules/common/tpm2/default.nix → .../hardware/x86_64-generic/modules/tpm2.nix b/modules/common/tpm2/default.nix → .../hardware/x86_64-generic/modules/tpm2.nix
@@ -6,10 +6,10 @@
   pkgs,
   ...
 }: let
-  cfg = config.ghaf.security.tpm2;
+  cfg = config.ghaf.hardware.tpm2;
 in
   with lib; {
-    options.ghaf.security.tpm2 = {
+    options.ghaf.hardware.tpm2 = {
       enable = mkEnableOption "TPM2 PKCS#11 interface";
     };
 

diff --git a/targets/lenovo-x1/everything.nix b/targets/lenovo-x1/everything.nix
@@ -60,9 +60,8 @@
               # Hardware definitions
               hardware.x86_64.common.enable = true;
               hardware.generation = generation;
-
               hardware.ax88179_178a.enable = true;
-              security.tpm2.enable = true;
+              hardware.tpm2.enable = true;
 
               # Kernel hardening
               host.kernel.hardening.enable = false;