From 124f8007a65ae685ea29439fadd5abdb3416d1e7 Mon Sep 17 00:00:00 2001
From: isabel <isabel@isabelroses.com>
Date: Fri, 29 May 2026 09:44:25 +0100
Subject: [PATCH] nixos/hardware/tpm: cleanup

---
 modules/base/users/mkuser.nix  |  2 +-
 modules/nixos/hardware/tpm.nix | 12 ++++--------
 2 files changed, 5 insertions(+), 9 deletions(-)

diff --git a/modules/base/users/mkuser.nix b/modules/base/users/mkuser.nix
index 4957e3f8..d435e5b7 100644
--- a/modules/base/users/mkuser.nix
+++ b/modules/base/users/mkuser.nix
@@ -40,7 +40,7 @@ in
             "input"
             "plugdev"
             "lp"
-            "tss"
+            "tss" # tpm2
             "power"
             "wireshark"
             "mysql"
diff --git a/modules/nixos/hardware/tpm.nix b/modules/nixos/hardware/tpm.nix
index b71fe035..c5e60889 100644
--- a/modules/nixos/hardware/tpm.nix
+++ b/modules/nixos/hardware/tpm.nix
@@ -2,7 +2,7 @@
 let
   inherit (lib.options) mkOption;
   inherit (lib.types) bool;
-  inherit (lib.modules) mkIf mkDefault;
+  inherit (lib.modules) mkIf;
 
   inherit (config.garden) device;
 in
@@ -15,19 +15,15 @@ in
 
   config = mkIf device.capabilities.tpm {
     security.tpm2 = {
-      # enable Trusted Platform Module 2 support
-      enable = mkDefault true;
-
-      # enable Trusted Platform 2 userspace resource manager daemon
-      abrmd.enable = mkDefault false;
+      enable = true;
 
       # set TCTI environment variables to the specified values if enabled
       # - TPM2TOOLS_TCTI
       # - TPM2_PKCS11_TCTI
-      tctiEnvironment.enable = mkDefault true;
+      tctiEnvironment.enable = true;
 
       # enable TPM2 PKCS#11 tool and shared library in system path
-      pkcs11.enable = mkDefault true;
+      pkcs11.enable = true;
     };
 
     boot.initrd.kernelModules = [ "tpm" ];
-- 
2.51.2