fixed sunshine and added tpm2 support

flake.nix

@@ -53,6 +53,7 @@
           ./hosts/Ratchet/misc_Ratchet.nix
           ./hosts/generic/persistence.nix
           ./hosts/generic/cups.nix
+          ./hosts/generic/security_quirks.nix
           ./desktop/kde.nix
           ./hosts/generic/unfree_allow.nix
           ./hosts/generic/virtualization.nix

hosts/generic/configuration_generic.nix

@@ -44,8 +44,8 @@
       networkmanager-openvpn
     ];
   };
-  networking.firewall.allowedTCPPorts = [ 22 3240 2049 25565 554 80 27040 8044 38008 ];
-  networking.firewall.allowedUDPPorts = [ 38401 25565 554 80 27031 27032 27033 27034 27035 27036 3658 38008 ];
+  networking.firewall.allowedTCPPorts = [ 22 3240 2049 25565 554 80 27040 8044 38008 47989 48010 48000];
+  networking.firewall.allowedUDPPorts = [ 38401 25565 554 80 27031 27032 27033 27034 27035 27036 3658 38008 47998 47999 47800 48010 48000];
   networking.nftables.enable = true;
 
   # tailscale

hosts/generic/security_quirks.nix

@@ -0,0 +1,7 @@
+{...}:
+{
+  security.tpm2.enable = true;
+  security.tpm2.pkcs11.enable = true;  # expose /run/current-system/sw/lib/libtpm2_pkcs11.so
+  security.tpm2.tctiEnvironment.enable = true;  # TPM2TOOLS_TCTI and TPM2_PKCS11_TCTI env variables
+  users.users.YOUR_USER.extraGroups = [ "tss" ];  # tss group has access to TPM devices
+}

hosts/generic/users.nix

@@ -5,6 +5,7 @@
     isNormalUser = true;
     extraGroups = [ "wheel" "incus-admin" "networkmanager" "libvirtd" ];
     shell = pkgs.fish;
+    uid = 1000;
     packages = with pkgs; [
       tree
     ];