Commit 3f3f18448f0a

@@ -18,8 +18,8 @@ REPO_URL="${REPO_URL:-https://git.sbr.pm/home.git}"
 REPO_PATH="${REPO_PATH:-$HOME/src/home}"
 SYSTEM_CONFIG="${SYSTEM_CONFIG:-aomi}"
 
-log_info()  { echo -e "${GREEN}[INFO]${NC} $*"; }
-log_warn()  { echo -e "${YELLOW}[WARN]${NC} $*"; }
+log_info() { echo -e "${GREEN}[INFO]${NC} $*"; }
+log_warn() { echo -e "${YELLOW}[WARN]${NC} $*"; }
 log_error() { echo -e "${RED}[ERROR]${NC} $*" >&2; }
 
 check_root() {
@@ -55,11 +55,11 @@ configure_nix() {
 
 	# Determinate installer enables flakes by default, but ensure our preferences
 	if [[ ! -f "$nix_conf" ]] || ! grep -q 'use-xdg-base-directories' "$nix_conf" 2>/dev/null; then
-		cat > "$nix_conf" <<-'EOF'
-		experimental-features = nix-command flakes
-		use-xdg-base-directories = true
-		extra-substituters = http://okinawa.vpn:5000
-		extra-trusted-public-keys = cache.okinawa.home:gp+IG0OaO4L/J0drL8OwmDtMPmdUq4kfLwg3mR8BkCs=
+		cat >"$nix_conf" <<-'EOF'
+			experimental-features = nix-command flakes
+			use-xdg-base-directories = true
+			extra-substituters = http://okinawa.vpn:5000
+			extra-trusted-public-keys = cache.okinawa.home:gp+IG0OaO4L/J0drL8OwmDtMPmdUq4kfLwg3mR8BkCs=
 		EOF
 		log_info "Nix config written to $nix_conf"
 	else
@@ -102,7 +102,7 @@ setup_selinux_policy() {
 	local tmpdir
 	tmpdir=$(mktemp -d)
 
-	cat > "${tmpdir}/nix-systemd.te" << 'POLICY'
+	cat >"${tmpdir}/nix-systemd.te" <<'POLICY'
 module nix-systemd 1.0;
 
 require {
@@ -160,6 +160,7 @@ install_native_apps() {
 	# Niri compositor + Wayland essentials + terminal
 	log_info "Installing niri, Wayland support, and kitty..."
 	sudo dnf install -y \
+		podman podman-docker \
 		niri \
 		kitty \
 		xwayland-satellite \
@@ -191,18 +192,44 @@ install_native_apps() {
 		log_info "Installing 1Password..."
 		sudo rpm --import https://downloads.1password.com/linux/keys/1password.asc
 		sudo tee /etc/yum.repos.d/1password.repo <<-'EOF'
-		[1password]
-		name=1Password Stable Channel
-		baseurl=https://downloads.1password.com/linux/rpm/stable/$basearch
-		enabled=1
-		gpgcheck=1
-		repo_gpgcheck=1
-		gpgkey=https://downloads.1password.com/linux/keys/1password.asc
+			[1password]
+			name=1Password Stable Channel
+			baseurl=https://downloads.1password.com/linux/rpm/stable/$basearch
+			enabled=1
+			gpgcheck=1
+			repo_gpgcheck=1
+			gpgkey=https://downloads.1password.com/linux/keys/1password.asc
 		EOF
 		sudo dnf install -y 1password 1password-cli
 	fi
 }
 
+# --- Phase 5: TPM 2.0 access ---
+
+setup_tpm() {
+	log_info "Configuring TPM 2.0 access..."
+
+	if [[ ! -e /dev/tpmrm0 && ! -e /dev/tpm0 ]]; then
+		log_warn "No TPM device found (/dev/tpm0, /dev/tpmrm0); skipping"
+		return 0
+	fi
+
+	# tpm2-tools gives tpm2_* utilities for inspection/testing
+	if ! command -v tpm2_pcrread &>/dev/null; then
+		sudo dnf install -y tpm2-tools
+	fi
+
+	# The tss group owns the TPM resource-manager device; membership is
+	# required for userspace access (age-plugin-tpm, ssh-tpm-agent, etc.)
+	if id -nG "$USER" | grep -qw tss; then
+		log_info "$USER already in tss group"
+	else
+		log_info "Adding $USER to tss group..."
+		sudo usermod -aG tss "$USER"
+		log_warn "Log out/in (or reboot) for tss group membership to take effect"
+	fi
+}
+
 # --- Phase 5: unscd for nix NSS resolution ---
 
 setup_unscd() {
@@ -226,18 +253,18 @@ setup_unscd() {
 	rm -rf "${tmpdir}"
 
 	# Create systemd service
-	sudo tee /etc/systemd/system/unscd.service > /dev/null <<-'EOF'
-	[Unit]
-	Description=Name Service Cache Daemon (unscd for nix)
-	After=sssd.service network.target
+	sudo tee /etc/systemd/system/unscd.service >/dev/null <<-'EOF'
+		[Unit]
+		Description=Name Service Cache Daemon (unscd for nix)
+		After=sssd.service network.target
 
-	[Service]
-	Type=forking
-	ExecStart=/usr/local/sbin/unscd
-	Restart=on-failure
+		[Service]
+		Type=forking
+		ExecStart=/usr/local/sbin/unscd
+		Restart=on-failure
 
-	[Install]
-	WantedBy=multi-user.target
+		[Install]
+		WantedBy=multi-user.target
 	EOF
 
 	sudo systemctl daemon-reload
@@ -329,7 +356,7 @@ setup_shell() {
 	if ! grep -q 'exec.*zsh' ~/.bashrc 2>/dev/null; then
 		log_info "Configuring bash to exec into zsh..."
 		# shellcheck disable=SC2016
-		echo '[[ $- == *i* && -x "$HOME/.local/state/nix/profile/bin/zsh" ]] && exec "$HOME/.local/state/nix/profile/bin/zsh"' >> ~/.bashrc
+		echo '[[ $- == *i* && -x "$HOME/.local/state/nix/profile/bin/zsh" ]] && exec "$HOME/.local/state/nix/profile/bin/zsh"' >>~/.bashrc
 	fi
 
 	log_info "Shell configured (zsh via bashrc exec)"
@@ -351,6 +378,7 @@ main() {
 	build_and_activate
 	setup_wireguard
 	install_native_apps
+	setup_tpm
 	setup_unscd
 	setup_home_manager
 	setup_shell