Commit 65ef4bca057a

Vincent Demeester <vincent@sbr.pm>
2026-06-11 12:36:57
feat(aomi): enable TPM-backed passage identity
Add age-plugin-tpm and age-plugin-yubikey, and drop the PASSAGE_IDENTITIES_FILE override that pointed at a nonexistent ssh key. Passage now decrypts via the machine-bound TPM age identity without a touch prompt.
main
1 parent 523b845
Changed files (1)
systems
aomi
home.nix
systems/aomi/home.nix
@@ -1,4 +1,4 @@
-{ pkgs, config, ... }:
+{ pkgs, ... }:
 {
   imports = [
     ../../home/common/services/usage-metrics.nix
@@ -27,14 +27,14 @@
   systemd.user.services.emacs.Service.ExecStartPre =
     "-/bin/sh -c 'until test -S /var/run/nscd/socket; do sleep 0.2; done'";
 
-  home.sessionVariables = {
-    PASSAGE_IDENTITIES_FILE = pkgs.lib.mkForce "${config.home.homeDirectory}/.ssh/id_ed25519";
-
-  };
-
   home.packages = with pkgs; [
     gnumake
 
+    # TPM-backed passage: TPM age identity (primary, machine-bound, no touch)
+    # + YubiKey plugin for recovery and re-encryption fallback
+    age-plugin-tpm
+    age-plugin-yubikey
+
     go-org-readwise
     gh-pr
     lazypr