encrypt ssh private keys with the tpm

flake.nix

@@ -69,6 +69,7 @@
             ./nixos/sudo.nix
             ./nixos/symlinks.nix
             ./nixos/tailscale.nix
+            ./nixos/tpm.nix
 
             {
               # enable bluetooth
@@ -97,6 +98,7 @@
                 users.${user} = {
                   imports = [
                     ./home-manager/plasma.nix
+                    ./home-manager/tpm.nix
                     ./home-manager/user.nix
                     ./home-manager/vscode.nix
                     {

home-manager/tpm.nix

@@ -0,0 +1,5 @@
+{
+  programs.ssh.extraConfig = ''
+    PKCS11Provider = /run/current-system/sw/lib/libtpm2_pkcs11.so
+  '';
+}

nixos/tpm.nix

@@ -0,0 +1,9 @@
+{ user, ... }:
+{
+  security.tpm2 = {
+    enable = true;
+    pkcs11.enable = true;
+    tctiEnvironment.enable = true;
+  };
+  users.users.${user}.extraGroups = [ "tss" ];
+}