From 9c1564e395cae6fe9106fafcaf00a7984e244541 Mon Sep 17 00:00:00 2001
From: Morgan Jones <me@numin.it>
Date: Wed, 21 May 2025 01:03:21 -0700
Subject: [PATCH] nixos/tpm2: default pkcs#11 module based on abrmd config

Since there are now variants of tpm2-pkcs11 with and without ABRMD
support (for the kernel resource manager), ensure we pick the correct
default.

Fixes an accidental backwards incompatibility with the module.
---
 nixos/modules/security/tpm2.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/nixos/modules/security/tpm2.nix b/nixos/modules/security/tpm2.nix
index f60adb24cdbe..bb947cb32a56 100644
--- a/nixos/modules/security/tpm2.nix
+++ b/nixos/modules/security/tpm2.nix
@@ -75,8 +75,8 @@ in
       package = lib.mkOption {
         description = "tpm2-pkcs11 package to use";
         type = lib.types.package;
-        default = pkgs.tpm2-pkcs11;
-        defaultText = lib.literalExpression "pkgs.tpm2-pkcs11";
+        default = if cfg.abrmd.enable then pkgs.tpm2-pkcs11.abrmd else pkgs.tpm2-pkcs11;
+        defaultText = lib.literalExpression "if config.security.tpm2.abrmd.enable then pkgs.tpm2-pkcs11.abrmd else pkgs.tpm2-pkcs11";
       };
     };