From 672199a31195c9c483b36e2c18d50c76c4cd9176 Mon Sep 17 00:00:00 2001
From: Fiona Behrens <me@kloenk.dev>
Date: Thu, 6 Mar 2025 17:31:06 +0100
Subject: [PATCH] strongswan: add enableTPM2 option and tpm2-tss library

Add a enableTPM2 option to the strongswan package and
conditionaly add tpm2-tss as input. This enables using tpm2 private
keys for strongswan as per documentation [0]

[0]: https://docs.strongswan.org/docs/5.9/tpm/tpm2.html
---
 pkgs/by-name/st/strongswan/package.nix | 4 ++++
 pkgs/top-level/all-packages.nix        | 1 +
 2 files changed, 5 insertions(+)

diff --git a/pkgs/by-name/st/strongswan/package.nix b/pkgs/by-name/st/strongswan/package.nix
index dfbac679e284..83405418bdca 100644
--- a/pkgs/by-name/st/strongswan/package.nix
+++ b/pkgs/by-name/st/strongswan/package.nix
@@ -5,6 +5,7 @@
 , systemd, pam
 , curl
 , enableTNC            ? false, trousers, sqlite, libxml2
+, enableTPM2           ? false, tpm2-tss
 , enableNetworkManager ? false, networkmanager
 , darwin
 , nixosTests
@@ -31,6 +32,7 @@ stdenv.mkDerivation rec {
   buildInputs =
     [ curl gmp python3 ldns unbound openssl pcsclite ]
     ++ lib.optionals enableTNC [ trousers sqlite libxml2 ]
+    ++ lib.optional enableTPM2 tpm2-tss
     ++ lib.optionals stdenv.hostPlatform.isLinux [ systemd.dev pam iptables ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin (with darwin.apple_sdk.frameworks; [ SystemConfiguration ])
     ++ lib.optionals enableNetworkManager [ networkmanager glib ];
@@ -80,6 +82,8 @@ stdenv.mkDerivation rec {
          "--with-tss=trousers"
          "--enable-aikgen"
          "--enable-sqlite" ]
+    ++ lib.optionals enableTPM2 [
+      "--enable-tpm" "--enable-tss-tss2" ]
     ++ lib.optionals enableNetworkManager [
          "--enable-nm"
          "--with-nm-ca-dir=/etc/ssl/certs" ]
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 9dc3848b4a9f..734ef2ae65b1 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -5037,6 +5037,7 @@ with pkgs;
   stutter = haskell.lib.compose.justStaticExecutables haskellPackages.stutter;
 
   strongswanTNC = strongswan.override { enableTNC = true; };
+  strongswanTPM = strongswan.override { enableTPM2 = true; };
   strongswanNM  = strongswan.override { enableNetworkManager = true; };
 
   stylish-haskell = haskell.lib.compose.justStaticExecutables haskellPackages.stylish-haskell;